Switchable authorization checks for RFC in SRM, SAP security note 2032723

SAP security note 2032723, "Switchable authorization checks for RFC in SRM", is a note. Below are the symptom and SAP recommended solution.

Description

Symptom

Previously, remote calls to RFC function modules were protected by the S_RFC authorization object. However, it was identified that these checks might not be sufficient to guarantee secure execution for certain RFC function modules in SRM. This note addresses this vulnerability by implementing additional authorization checks.

Solution

The note provides new switchable authorization checks that are delivered inactive by default to ensure compatibility with existing processes. New authorization scenarios are introduced and can be activated via transaction SACF using the correction instructions attached to the note.

• Upload the scenario definition using the attached BBP_VENDOR_GET.txt file if it does not already exist in SACF.
• Create a productive authorization scenario from the scenario definition and activate it.
• Optionally enable logging of SACF relevant audit messages in the Security Audit Log.
• Adjust roles to provide necessary authorizations based on the new scenarios.

Authorization scenarios introduced: BBP_VENDOR_GET for reading vendor-specific master data; PSM_MASTERDATA for Public Sector Management and Funds Management master data; FI_DOC_READ for displaying accounting documents via RFC.

Reason and prerequisites

Remote Function Call (RFC) function modules require stringent authorization checks to maintain system security. The existing S_RFC checks were found lacking in some scenarios, necessitating the introduction of switchable authorization checks.

CVSS

Score 6.3 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References

• 2078596 – Further improvements for RFC security