Skip to main content
SAP Pentest Playbook
Toggle Dark/Light/Auto mode Toggle Dark/Light/Auto mode Toggle Dark/Light/Auto mode Back to homepage
  2. /
  3. SAP ABAP Platform
  4. /
  5. Known Attack Vectors
  6. /
  7. Remote ABAP Report Execution via XBP Background Jobs
Edit page

Remote ABAP Report Execution via XBP Background Jobs

Description

The XBP (eXternal Background Processing) interface is the BAPI_XBP_*/BAPI_XMI_* BAPI family SAP exposes for external job schedulers (Control-M and similar). Because it lets a caller open, populate, start, and monitor a background job entirely over RFC, it doubles as a way to run any standard, existing ABAP report on a target system without SE38/SA38 GUI access and without going anywhere near RFC_ABAP_INSTALL_AND_RUN or S_DEVELOP. It runs existing reports rather than arbitrary source, so impact is bounded by which reports the job user is authorized to run (S_PROGRAM) - but background jobs can be scheduled to run under a different user given the right authorizations, making this a privilege-context and stealth vector: it executes outside interactive transaction monitors and is authorized via job-scheduling objects rather than development ones, so it can succeed where classic code-exec FMs are locked down.

Flow: BAPI_XMI_LOGON(INTERFACE='XBP', VERSION='3.0') (mandatory before any BAPI_XBP_* call) -> BAPI_XBP_JOB_OPEN -> add the target report as a job step -> BAPI_XBP_JOB_START_IMMEDIATELY -> poll BAPI_XBP_JOB_STATUS_GET -> read the job log/spool via BAPI_XBP_JOB_SPOOLLIST_READ -> BAPI_XMI_LOGOFF.

The same sequence is the standard technique for RFC-landscape discovery: scheduling and running the report RSRFCCHK (SAP’s RFC-connection-check report) this way and parsing its spool output enumerates every SM59 destination with a stored password - see critical RFC-enabled function modules for what a compromised RFC credential subsequently unlocks.

Risk

An attacker with a working RFC credential and XBP/background-scheduling authorizations - but no development access - can execute any report the job user may run, under the job user’s context, with output (spool/joblog) returned over RFC. Combined with authorization to schedule as a different, privileged user (e.g. DDIC), this becomes a direct privilege-escalation path independent of S_DEVELOP/code-execution controls. It also serves as a stealthy landscape-discovery primitive (RSRFCCHK) that bypasses RFC_READ_TABLE/S_TABU_DIS restrictions on RFCDES entirely.

Options

  • Precondition: valid RFC logon with S_RFC for the BAPI_XBP_*/BAPI_XMI_* function group, S_XMI_LOG (XMI interface), S_BTCH_JOB (background scheduling), S_BTCH_NAM/S_BTCH_ADM if scheduling to run as another user, and S_PROGRAM authorization for the target report.
  • Run a report over RFC - BAPI_XMI_LOGON(INTERFACE='XBP', VERSION='3.0') -> BAPI_XBP_JOB_OPEN(JOBNAME=...) -> add the report as an ABAP program job step -> BAPI_XBP_JOB_START_IMMEDIATELY -> poll job status -> read spool/joblog -> BAPI_XMI_LOGOFF. Tool: SAPMAP modules/data_extraction/poc_remote_abap_exec.py.
  • Landscape/trust discovery use case - schedule and run RSRFCCHK this way to enumerate every configured RFC destination with a stored password; falls back to RFC_READ_TABLE on RFCDES, then a raw call_raw-based read bypassing RFC_GET_FUNCTION_INTERFACE metadata checks, then GET_TABLEBLOCK_COMPRESSED_RFC if XBP itself is unavailable. Tool: SAPMAP modules/discovery/sapmap_rfc.py - retrieve_rfc_connections().
  • Privilege escalation via job user - schedule the job to run as a privileged account (DDIC, a service batch user) where S_BTCH_NAM/S_BTCH_ADM permit - the report then executes with that user’s authorizations.
  • Manual equivalent: SM36/SM37 (schedule/monitor jobs with GUI access), SA38 (run a report directly if authorized).

Mitigation

  • Restrict the XBP/XMI interface authorizations (S_RFC for the BAPI_XBP_*/BAPI_XMI_* function group, S_XMI_LOG) to genuine external-scheduler service accounts.
  • Restrict background-scheduling objects S_BTCH_JOB, S_BTCH_NAM, S_BTCH_ADM - in particular, do not allow non-Basis accounts to schedule jobs to run as another user.
  • Restrict S_PROGRAM so job users cannot execute sensitive reports; monitor jobs scheduled to run under privileged users (DDIC and similar) outside change-controlled windows.
  • Apply the same RFC-trust hygiene as critical RFC-enabled function modules - this path reaches the same RFCDES/RFCTRUST/RFCSYSACL data via a different route.

Detection and Monitoring

  • Security Audit Log: XMI/XBP logon events (S_XMI_LOG), especially BAPI_XMI_LOGON followed immediately by RSRFCCHK job scheduling/execution from an unexpected user/source outside scheduled Basis housekeeping.
  • SM37: background-job creation/start, especially jobs scheduled to run as privileged users.
  • Anomalous BAPI_XBP_*/BAPI_XMI_LOGON RFC calls from unexpected sources or outside known scheduler service accounts.

References