Switchable authorization checks for RFC in CO-OM and CO-PA, SAP security note 2024225

SAP security note 2024225, "Switchable authorization checks for RFC in CO-OM and CO-PA". Below are the symptom and SAP recommended solution.

Description

Symptom

SAP Note 2024225 addresses a critical security enhancement by introducing switchable authorization checks for RFC (Remote Function Call) function modules in the Controlling Overhead Costing (CO-OM) and Profitability Analysis (CO-PA) applications. This update is essential to prevent unauthorized access and potential privilege escalation within these modules.

Authenticated users may exploit certain functions in CO-PA that lack sufficient authorization checks, potentially leading to unauthorized access and escalation of privileges. This SAP note provides a solution by implementing additional authorization controls to ensure secure execution of RFC function modules.

• CO-PA Vulnerability: users can access restricted functions in CO-PA without proper authorization, leading to potential privilege escalation.
• Insufficient RFC Checks: existing S_RFC authorization checks may not be adequate for all RFC function modules, necessitating enhanced security measures.

Solution

Implement the support package or correction instructions provided in this SAP note to activate new switchable authorization checks. These checks are initially inactive to maintain compatibility with existing processes and require manual activation via transaction SACF.

• Activate authorization checks – create authorization scenario definition: go to transaction SACF and verify if COOM_MASTERDATA and COOM_PLANNING scenarios exist. If not, download the CO_OM_SACF_SCENARIO_DATA.TXT file and upload it using SACF_TRANSFER.
• Create productive authorization scenario: in SACF, transfer the scenario definitions to productive scenarios and set the status to "Active" or "Logging".
• Configure Security Audit Log: ensure the Security Audit Log is active via transaction SM19. Create and activate relevant audit filters to monitor authorization events.
• Update user roles: use report RSAU_SELECT_EVENTS to identify users needing additional authorizations. Adjust roles to include necessary authorizations based on the new scenarios.

References

• 2078596 – Further improvements for RFC security