Missing whitelist check in GRC-ACP, SAP security note 2039348

SAP security note 2039348, “Missing whitelist check in GRC-ACP”, is a program error note released on 11.11.2014. Below is the security information published by SAP for this note.

Description

Symptom

An authenticated user can use functions of GRC-ACP to which access should be restricted. This may result in an escalation of privileges.

Reason and prerequisites

GRC-ACP does not perform required checks against a whitelist of allowed functions during execution. This absence can lead to unauthorized access to restricted functions.

Solution

Implement the provided support package or follow the correction instructions along with the attached manual instructions.

#### Manual Activities 1. Maintain entries in the table SRT_WHITE_LIST:

• If the table does not exist, implement note #1560878 first.
• Go to transaction SE11, open table SRT_WHITE_LIST in display mode.
• Navigate to Utilities → Table Contents → Create Entries.
• Enter OBJECT_TYPE as 'FUNC' and OBJECT_NAME as the NON-GRCPI function name you wish to call.
• Save the changes.

2. Update Message Class:

• Go to Transaction SE91 and open the message class /GRCPI/GRIA_MSG.
• Create or change Message 175 with the short text: "Function Module does not exist in Whitelist".
• Save the changes.

References

• 2040515 – Master Note for SAP Access Control 10.1 – Support Pack 07
• 2036679 – Master Note for SAP Access Control 10.0 – Support Pack 17