Security Note rfcexec/startrfc Used in File Interfaces, SAP security note 1140031

SAP security note 1140031, "Security Note: rfcexec/startrfc Used in File Interfaces". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

Questions about the security of rfcexec and the RFC Library used in this context.

Solution

In general, there are 3 options to secure the file interface with triggering with respect to vulnerabilities exposed by the RFC Library. For any solution using RFC communication, SAP strongly recommends securing the connection by SNC.

Option 1: Triggering using SAP NetWeaver RFC Library.

• Based on the SAP NetWeaver RFC Library (SAP note #1025361)
• ALE-tailored rfcexec and startrfc executables are provided in SAP NetWeaver RFCSDK 7.10 Patch Level 2 (SAP note #1058327), which can be downloaded from the SMP.
• Benefits from security improvements of the SAP NetWeaver RFC Library compared to classic RFC Libraries ASCII and Unicode.
• startrfc can only invoke function modules EDI_DATA_INCOMING and EDI_STATUS_INCOMING.
• rfcexec checks that the command is requested by the ALE layer (requires kernel 6.40 Patch-level 236, 7.00 Patch-level 163 or 7.10 Patch-level 107) and can be accompanied by a configuration file.
• Each line of the configuration file includes:
  • The command, checked against the value from the port definition
  • System ID
  • Client ID
  • User name

Option 2: Triggering using classic RFC Library.

• rfcexec based on the classic RFC Library is a generic RFC server, which can be controlled by a list of forbidden commands (blacklist).
• See SAP note #618516 for more details.
• Both the blacklist and the classic RFC Library carry security risks due to their complexity.

Option 3: Don't use the trigger!

• Without the trigger, the ALE file interfaces do not require any RFC functionality, and RFC Libraries can be removed (ensure there are no other use cases).
• Currently ambiguous for the subsystem to decide when a file has been finally created by the ALE interface.
• Scheduling SAP to create IDoc files and the subsystem to consume these files may be challenging.
• An ALE development will be available for SAP NetWeaver 7.11 onwards (SAP note #1169005), establishing a file-based handshake for the IDoc files.

References

• #1581595 – rfcexec or startrfc are missing after upgrade
• #1481923 – Possible execution of arbitrary commands in RFC SDK tools
• #1169005 – IDoc file creation without triggering with rfcexec
• #1058327 – SAP NW RFC SDK 7.10 — Patch-Level 2
• #1025361 – Installation, Support and Availability of the SAP NetWeaver RFC Library 7.20
• #618941 – EDI: Authorization check when triggering the file output
• #618516 – Security-related enhancement of RFCEXEC program
• #27517 – Installation of RFC SDK

Affected components

• KRNL32NUC: 6.40, 7.00 to 7.01, 7.10
• KRNL32UC: 6.40, 7.00 to 7.01, 7.10
• KRNL64NUC: 6.40, 7.00, 7.10
• KRNL64UC: 6.40, 7.00 to 7.01, 7.10
• SAP RFCSDK: 6.20, 6.40, 7.00, 7.10
• NWRFCSDK: 7.10+