AUTHORITY_CHECK permits testing using RFC, SAP security note 1580244

SAP security note 1580244, "AUTHORITY_CHECK Permits Testing Using RFC". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

SAP Security Note 1580244 addresses a vulnerability where the function module AUTHORITY_CHECK, being remote-enabled, allows attackers to access user authorization information. This information disclosure can be exploited for targeted attacks against users.

Failure to apply this security note may allow unauthorized users to retrieve authorization information, potentially facilitating further security breaches.

Solution

• Automatic mitigation: use the Note Assistant (SNOTE) to implement the correction instructions provided in the note, or import the relevant Support Package for your SAP_BASIS version.
• Manual mitigation (if automatic steps are not feasible): create function group SU_RAUTH (development class SUSR, short text "Authority check from external system"), save and activate the changes. Create function module RFC_GET_LAST_FUNCTION_MODULE in function group URFC, which delivers the last function module called via RFC. Create function module SU_RAUTH_CHECK_FOR_USER in function group SU_RAUTH, which performs remote-enabled authority checks for users other than sy-uname and includes several import parameters for detailed authorization checks.

CVSS

Score 3.5 Vector: AV:N/AC:M/AU:S/C:P/I:N/A:N

References

• SAP Note 1777512

Affected components

• SAP_BASIS: 46C, 620, 640, 700, 710, 711, 720, 730, 731