Missing authorization check, SAP security note 1553180

SAP security note 1553180, “Missing authorization check”, is a note. Below are the symptom and SAP recommended solution.

Description

Symptom

An authenticated user can use certain functions of SAP systems without having the required authorization for this. This enables the user to display any text for a different user in a dialog box.

Solution

• Implement the attached correction instructions. You can download them here.
• Set the undocumented profile parameter rdisp/th_popup/strict_check = 1.
• Execute the authorization check for the authorization object S_ADMI_FCD from the class BC_A.
• In transaction SE12, manually create a new entry for the domain XUFUNCTION:
  • Choose “Change” and switch to the “Value Range” tab.
  • Go to “Single Vals”.
  • Enter the following new fixed value: Fix.Val.: POPU, Short Description: TH_POPUP.
  • Activate the domain XUFUNCTION.

After these steps, the problem is resolved as of the listed Support Packages.

Reason and prerequisites

SAP systems do not contain authorization checks for verifying an authenticated user’s authorization to access some of their functions. Without these checks, an authenticated user can call these functions without the desired system behavior.

CVSS

Score 4.0 Vector: AV:N/AC:L/AU:S/C:N/I:N/A:P