SAP security note 1955908, "Missing authorization check in BC-BMT-WFM", is a note. Below are the symptom and SAP recommended solution.
Description
Symptom
An authenticated user can call functions of BC-BMT-WFM, even though this should be restricted. This may result in an escalation of privileges.
Solution
Apply the relevant Support Packages or the corrections provided in this SAP Note to enhance the affected functions with the necessary transaction authorizations for verifying assigned users.
Assign the relevant business Workflow end users the start authorization for the following transactions:
- SWNWIEX
- SWFPOWLWI
- WI_EXECUTE
Ensure the following access points to work items are secured:
- URLs in the extended notification e-mail messages
- Calls from the Web Dynpro application SWF_WORKPLACE
- Forms in SAP GUI for HTML invoked using the business object type DYNP_FORM
Reason and prerequisites
In BC-BMT-WFM, a check of assigned users is generally carried out before the execution of workflow steps, and processing is declined if the relevant assignment is missing. However, there are no additional checks to determine whether a user is permitted to call certain functions. This oversight may lead to undesired system behavior.
References
Full note on SAP: SAP Support Launchpad note 1955908
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].