Skip to main content
SAP Pentest Playbook
Toggle Dark/Light/Auto mode Toggle Dark/Light/Auto mode Toggle Dark/Light/Auto mode Back to homepage
  2. /
  3. SAP Business Technology Platform
  4. /
  5. Known Attack Vectors
  6. /
  7. Job Scheduler & Build / Work Zone
Edit page

Job Scheduler & Build / Work Zone

Description

Two smaller under-examined surfaces that share a theme with the rest of the section: standing, unattended credential-bearing callers (Job Scheduler) and low-code apps that reuse powerful destinations or leak secrets to the browser (Build Apps / Work Zone).

Risk

Job Scheduler turns every schedule into a standing credential-bearing caller; low-code Build apps can bake secrets into the client bundle or ride a shared high-privilege technical-user destination so any app user inherits that identity regardless of their own authorization.

Options

  • Job Scheduler - standing credential-bearing callers: scheduled jobs call app endpoints on a schedule, carrying the auth (often an OAuth2ClientCredentials destination, or a stored token/basic credential) needed to reach the target. Every schedule is thus a standing, unattended credential-bearing caller. Test: enumerate jobs and their bound destinations; check destination read scopes and any basic-auth password stored in destination properties.
  • Build Apps / Work Zone - client-side secrets & destination reuse: low-code Build apps bind to destinations to reach backends. Two classic low-code risks to test:
    • config/API keys baked into the client bundle shipped to the browser - pull the published web bundle and inspect for embedded config/keys;
    • destination reuse - a Build app inheriting a powerful shared technical-user destination so any app user rides that identity regardless of their own authorization. Map which destinations a low-code app uses and whether they carry a shared technical user vs. principal propagation.

Mitigation

  • Job Scheduler: prefer principal propagation / short-lived tokens over stored basic auth; least-privilege on job and destination management.
  • Build: use principal propagation, not shared technical-user destinations; keep secrets server-side / in Credential Store; least-privilege any technical user behind a shared destination.

Detection and Monitoring

  • Audit Job Scheduler job creation/edits and Build destination changes.
  • Subject to the BTP Audit Log’s coverage limits - see BTP Audit Blind Spots.

References