IDoc inbound processing via HTTP/SOAP, SAP security note 1487606

SAP security note 1487606, "IDoc Inbound Processing via HTTP/SOAP Vulnerability". Below are the symptom and SAP recommended solution.

Description

Symptom

IDoc inbound processing via HTTP or SOAP that is not required takes place if the relevant ICF services are incorrectly activated and the IDoc authorization granted is not restrictive enough.

Solution

• Deactivate Unused Services – If the activated services are not used in your landscape, deactivate “/sap/bc/IDoc_XML” or “/sap/bc/srt/IDoc” in transaction SICF.
• Verify Service Usage – Analyze the ICMan server log via transaction SMICM → Goto → HTTP Log to determine if these services are in use. Documentation for the ICMan server log can be found on the SAP Help Portal (German, English).
• Restrict Authorizations – Ensure that the authorization object B_ALE_RECV with field EDI_MES is properly configured to allow only desired message types. Refer to SAP Note 1487928 for more details on HTTP IDoc inbound processing authorization checks.
• Suppress Unauthorized Processing – Ensure no partner profiles exist or set existing partner profiles to “Processing in background” mode in transaction WE20, allowing only internal user processing.
• Use Web Service Framework – For systems running SAP NetWeaver 2004 (Web Application Server 640+) and above, migrate to the Web Service Framework (SOAP Migration Guide 6.20 to 6.40).

Reason and prerequisites

• Activation of services “/sap/bc/IDoc_XML” (Release 6.20+) or “/sap/bc/srt/IDoc” (Release 6.40+) in transaction SICF allows sending and processing IDocs if the user has relevant authorizations.
• This setup can lead to security risks, especially in internet or intranet scenarios.
• Refer to SAP Note 40689 for information on standard passwords.

References

• SAP Note 93254 – RFC short dump RFC_NO_AUTHORITY
• SAP Note 626073 – Unreleased Internet Communication Framework services
• SAP Note 40689 – New reports for the User Information System
• SAP Note 1487928 – Authorization check in HTTP IDoc inbound processing
• SAP Note 1394100 – Security note: Access to RFC-enabled modules via SOAP
• SAP Note 1394093 – Collective Security Note
• SAP Note 1504652 – Consulting: Secure Configuration of Application Server ABAP
• SAP Note 2344552 – Important SAP Basis notes for integrating between a SAP on-premise system and Cloud for Customer