Security check when you execute external commands, SAP security note 686765

SAP security note 686765, “Security check when you execute external commands”, is a note. Below are the symptom and SAP recommended solution.

Description

Symptom

You aim to enhance the security level of your SAP system concerning the execution of external commands. Currently, if a user possesses authorizations to create and execute external commands and create RFC destinations in SAP system ABC, they can execute external commands on other hosts that are accessible via TCP/IP from the SAP system, host the SAP RFC server program SAPXPG, and have an SAP application server running or an operating system user like <ABC>adm. This access remains possible even without specific host authorizations.

Solution

As of SAP Kernel Web AS 620, a new SAPXPG program with an integrated security check is available on the SAP Service Marketplace. This program ensures that external commands are executed only if the user passes the security check.

• Compatibility and Replacement: compatible with SAP releases from Release 4.6B onward. Replace existing SAPXPG programs with the latest version from Web AS 620 or higher. Example: for systems using kernel 4.6D or later, replace SAPXPG with the version from Web AS 620. Future Web AS releases (e.g., Web AS 640) will provide updated SAPXPG programs.
• Installation: the new SAPXPG program is part of SAP Kernel Web AS 620 with patch number 8. Note: an incorrect SAPXPG version was briefly released for AS400 but was corrected on March 3, 2004.
• Security Check Activation: a main control switch activates the security check: the environment variable SAPXPG_SEC_CHECK. Setting SAPXPG_SEC_CHECK to any single-digit value enables the security check. The system logs the status in the dev_cp trace file.
• Configuration: the new SAPXPG reads a sapxpg.sec file containing security settings. Set the file path using the SAPXPG_SEC_FILE_PATH environment variable. File format example: /U/*/C/*/T/3/F/*/O/rm,cp/S/*/ – this example disallows the rm and cp operating system commands for all users.
• UNIX Environment Setup: rename the existing SAPXPG executable (e.g., to SAPXPG_EXE). Create a shell script named SAPXPG that sets the necessary environment variables and invokes the renamed executable. Example script: #!/usr/bin/csh setenv SAPXPG_SEC_CHECK X setenv SAPXPG_SEC_FILE_PATH /<dir1>/<dir2>/... /<dir_executable>/SAPXPG_EXE $*

Reason and prerequisites

The executing program, SAP RFC SAPXPG server program, lacks a security check, allowing unauthorized execution of external commands.

References

• 864152 – Exception SECURITY_RISK with external command