SAP security note 2003859, “Missing authorization check in SRM Shopping cart”, is a note. Below is the security information published by SAP for this note.
Description
Symptom
An authenticated user can access functions of Shopping cart data that should be restricted, potentially leading to an escalation of privileges.
Additional functional authorization checks required for the shopping cart were not called in all necessary places. This oversight may result in unauthorized access to SRM shopping cart data, potentially disclosing sensitive information to users without the appropriate permissions.
Solution
To address this issue, implement the corrections provided in SAP Note 2003859 or import the relevant support packages. Additionally, ensure that employee users are not assigned the 'SO' activity for the 'Process Shopping Carts' authorization object. Only specify the required activities and avoid using wildcards (*).
Manual Steps: 1. Classes and Methods:
- Modify classes /SAPSRM/CL_PDO_BO_SC and /SAPSRM/CL_PDO_BO_SC_ADV via transaction SE24 by adding specific parameters.
- Update class /SAPSRM/CL_PDO_FACTORY_SC_ADV by adding a static attribute MV_SCENARIO.
2. Function Modules:
- Update function module BBP_PDSEC_AUTHORITY_CHECK via SE37 by adding a new parameter IV_AUTH_CHECK_MODE.
3. Role Changes:
- In transaction PFCG, open and modify roles such as /SAPSRM/EMPLOYEE, /SAPSRM/EMPLOYEE_EHP1, /SAPSRM/EMPLOYEE_ESS, and /SRMNXP/EMPLOYEE to uncheck the 'SO' activity for the 'Process Shopping cart' authorization object.
- Download the updated role files from the attached Roles.zip.
Attachments:
Preconditions: Ensure that the following SAP Notes are implemented to avoid conflicts:
- 1499352 – SRM Transfer: Redesign, bug fixes
- 1651597 – Program POWL_WLOAD to refresh PO queries for changed auth
- 1681695 – Catalog ID not passed to items during cross catalog search
- 1687345 – IV_USERNAME does not exist in FM BBP_PDSEC_AUTHORITY_CHECK
- 1731748 – Time lost retrieving PO not in PGroup authorizations
- 1919872 – Purchasing Group not correctly determined on copy SC
- 1669032 – Changes during recall of shopping cart not reflected
- 1701539 – Account index re-number with copy functionality in SC
- 1959126 – Unwanted contract relevant information update in PO
- 1910586 – Tax code reverted back when approving PO/SC
For detailed instructions and updates, refer to the SAP Note 2003859.
*Credits to RedRays.io for supporting the provision of this information.*
Full note on SAP: SAP Support Launchpad note 2003859
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].