SAP GUI on Microsoft Windows or Internet Explorer can also be used for single sign-on. There are several portal-based authentication applications for single sign-on. SAP GUI can have single sign-on with SAP Logon Ticket as well. Single sign-on also works in the Java GUI.4
SAP is a distributed application, where client software (SAP GUI) installed on a user's workstation is used to access the central SAP server remotely over the company's network. Users need to authenticate themselves when accessing SAP. By default, however, SAP uses unencrypted communication, which allows potential company-internal attackers to get access to usernames and passwords by listening on the network. This can expose the complete SAP system, if a person is able to get access to this information for a user with extended authorization in the SAP system. Information about this feature is publicly accessible on the Internet.
SAP offers an option to strongly protect communication between clients and servers, called Secure Network Communications (SNC).5
In total, the vendor has released 25 security patches (aka SAP Security Notes). One of the most notorious vulnerabilities was closed among the set of fixes released in March 2017. The vulnerability in the SAP GUI client for Windows allows remote code execution.6 Also, researchers who identified the security issues pointed out that the vulnerability allows an attacker to download ransomware on the SAP server that would be automatically installed on every workstation within a company.7
Since 1998 SAP GUI screens (so-called "DynPros") can be adjusted and customized with GuiXT. Now this can also be achieved with "SAP Screen Personas". Personas is installed on one of the SAP NetWeaver ABAP 7.0x or 7.3x servers in the system landscape. Then it can be used on all SAP NetWeaver ABAP servers with a kernel of 7.21 or higher, including on NetWeaver ABAP 7.11 systems (on which Personas cannot be installed directly).
Native iOS and Android implementations of SAP GUI are available from GuiXT.
"The SAP GUI Scripting API How to Automate User Interaction -Technology, Examples and Integration". Retrieved January 27, 2022. http://www.sdn.sap.com/irj/scn/go/portal/prtroot/docs/library/uuid/80aaac18-2dfe-2a10-bbb1-ec9b3760ea4c ↩
"Lifetime and Support Matrix for SAP GUI for Windows". Retrieved July 22, 2018. http://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/d0f3985b-ebf4-2a10-acba-9d7fe5d3d1d0?QuickLink=sap-gui&overridelayout=true ↩
"Supported SAP GUI platforms". April 25, 2018. Retrieved July 22, 2018. https://launchpad.support.sap.com/#/notes/66971 ↩
"Single Sign-on for SAP Java GUI". January 10, 2009. Retrieved July 22, 2018. http://honk.sigxcpu.org/con/Enabling_Kerberos_in_the_SAP_GUI_for_Java.html ↩
"Secure Network Communications (SNC)". Retrieved July 22, 2018. https://help.sap.com/viewer/621bb4e3951b4a8ca633ca7ed1c0aba2/7.52.2/en-US/aa38ff4fa187622fe10000000a44176d.html ↩
Michael Mimoso (March 22, 2017). "SAP Vulnerability Puts Business Data at Risk for Thousands of Companies". Threatpost | The first stop for security news. Retrieved July 22, 2018. https://threatpost.com/sap-vulnerability-puts-business-data-at-risk-for-thousands-of-companies/124473/ ↩
"Can SAP Be Affected By Ransomware? | SAP Cyber Security Solutions". erpscan.com. Retrieved July 22, 2018. https://erpscan.com/sap-ransomware/ ↩