Missing authorization check in FM PRGN_INTERFACE_USER, SAP security note 1406435

SAP security note 1406435, "Missing Authorization Check in FM PRGN_INTERFACE_USER", is a note. Below are the symptom and SAP recommended solution.

Description

Symptom

The function modules SUPRN_INS_OR_DEL_PROFILE and PRGN_INTERFACE_USER (intended for internal use) allow bypassing the authorization check of user management. Specifically, the module PRGN_INTERFACE_USER has a parameter that controls the necessity of the authorization check. If this parameter is not set, authorization profiles can be added to a user without the executing user having the required authorizations. This loophole allows users to assign authorizations to themselves or others without proper permissions, which is not possible in standard SAP programs. However, in customer-specific programs or using transaction SE37 in test mode, this authorization concept can be circumvented.

Solution

Implement the attached correction instructions using SNOTE or import the relevant Support Package.

Workaround

To mitigate the risk before applying the correction:

• Restrict the authorization to use transaction SE37 in test mode, especially in productive environments.
• Ensure that users do not have authorization to test or execute the function modules SUPRN or PRGN_USERPROF using the authorization object S_DEVELOP.
• Use transaction SUIM to identify users and profiles with the following authorizations: authorization object S_DEVELOP, activity 16, object type FUGR, object names SUPRN or PRGN_USERPROF.
• Remove these authorizations to eliminate the risk of unauthorized profile assignments.

Reason and prerequisites

The issue arises due to a program error combined with an inadequate authorization concept.

References

• Automatic checks for security notes using RSECNOTE (outdated)