Missing Authorization Check in remote ABAP Config Access, SAP security note 1488609

SAP security note 1488609, "Missing Authorization Check in remote ABAP Config Access", is a note released on 14.12.2010. Below are the symptom and the SAP recommended solution.

Description

Symptom

An authenticated user can access remote configuration data to which access should be restricted. This can potentially result in an escalation of privileges.

Solution

Option 1:

• Apply the corresponding Support Package to your system: 6.40 SP 27, 7.00 SP 23, 7.01 SP 8, 7.02 SP 6, 7.10 SP 11, 7.11 SP 6.
• Extend the activities of the role SAP_BC_AI_LANDSCAPE_DB_RFC using transaction PFCG: choose the “Authorizations” tab, change to edit mode, press the “Change Authorizations” button, extend the authorization for LCR Database by the read (No.33) and administer (No.70) activities, then save the changes and generate the profile.
• Activate the authority check: run transaction SXMB_ADM, choose “Integration Engine Configuration”, press the “Specific Configuration” button, switch to edit mode, press the “New Entries” button and add the following setting – Category: Runtime, Parameter: EX_PROFILE_READ_AUTH, Current Value: 1. Save the changes.

Option 2 (for systems with support package levels lower than Option 1):

• Modify the system objects and apply the note: change Authorization Object using transaction SU21 and add activities ‘read’ (No.33) and ‘administer’ (No.70) to S_LCRDB. Run transaction SM30 to maintain table SXMSCONFDF and add entry – Category: RUNTIME, Parameter: EX_PROFILE_READ_AUTH, Value: 0 (default value – check is deactivated), Documentation Object: XMB_OP_RUNTIME, Subparam. Dynamic: No. Then import the note corrections.
• Extend the activities of the role SAP_BC_AI_LANDSCAPE_DB_RFC using transaction PFCG, following the same steps as in Option 1.
• Activate the authority check, following the same steps as in Option 1.

Reason and prerequisites

A remote-enabled function module lacks permission checks for an authenticated user’s authorization to access configuration data remotely.

References