Dangerous Permissions Audit

Dangerous Permissions Audit Report

Report ID: security-dangerous-permissions Category: Security

Purpose

This report identifies permission lists that grant access to dangerous capabilities in PeopleSoft. Each of the eight checks is a known attack path: SOAP-to-CI lets a permission-list holder call any Component Interface without a dedicated service operation, USERPROFILES lets them mint new accounts, IB_NODE lets them point a node at attacker-controlled infrastructure. Each category is assigned a severity level (CRITICAL or HIGH) to help prioritize remediation.

What It Checks

The report audits 8 categories of dangerous access:

CRITICAL Severity

HIGH Severity

Table Queried

PSAUTHITEM — Authorization Items

Queried once per category with the specific WHERE clause for that check.

PSROLECLASS — Role/Permission List Assignments

Queried per permission list found, via GetPermissionListRoles.

PSOPRALIASTYPE / PSOPRDEFN — User Counts

Queried in batch via GetUnlockedUserCountForRoles to count unlocked users per role.

Data Flow

1. For each of 8 dangerous capability categories:
        |
        v
2. Query PSAUTHITEM with category-specific WHERE clause
   -> Extract unique permission lists (CLASSID)
        |
        v
3. For each permission list found:
   -> Fetch assigned roles via PSROLECLASS
        |
        v
4. Batch query unlocked user counts for all roles
        |
        v
5. Sort findings by total unlocked user count (descending)
        |
        v
6. Generate per-category section with severity badge,
   description, and permission list table
        |
        v
7. Generate summary and recommendations

Parameters

This report has no configurable parameters.

Report Output

The generated report contains:

• Header with database name and generation timestamp
• Per-category sections (8 total), each with:
  • Severity badge (CRITICAL or HIGH)
  • Description of the dangerous capability
  • Count of permission lists with this access
  • Table with: Permission List (linked), Roles, Unlocked User count
  • Or “No findings” if no permission lists have this access
• Summary with total categories checked and total permission lists found
• Recommendations for each category

Interpreting Results

• CRITICAL findings should be reviewed immediately. SOAP-to-CI access, user profile management, and node configuration can all be used for privilege escalation or unauthorized data access.
• HIGH findings should be scheduled for remediation. These capabilities are security-sensitive but may have legitimate use cases in limited quantities.
• Permission lists with no roles assigned may be orphaned but should still be reviewed — they could be assigned in the future.
• High unlocked user counts indicate broad exposure to the dangerous capability and should be prioritized for remediation.
• Display-only access is excluded. The report only flags non-display-only (DISPLAYONLY = 0) access for menu-based checks, so findings represent actual write/execute capability.

Recommendations

1. Remove WEBLIB_SOAPTOCI access in production environments unless absolutely required for integration — use dedicated service operations instead
2. Restrict WSDL generation to development environments only; in production, serve static WSDL files
3. Limit user profile management to a small number of designated security administrators
4. Implement change management processes for role and permission list modifications
5. Restrict purge operations to emergency use only and require approval workflows
6. Audit node configuration access regularly, as nodes contain authentication credentials