Missing authorization check in XAP-MBA-DSD, SAP security note 2071371

SAP security note 2071371, “Missing authorization check in XAP-MBA-DSD”, is a note. Below is the security information published by SAP for this note.

Description

Symptom

An authenticated user can use certain functions to which access should be restricted. This may result in an escalation of privileges.

Reason and prerequisites

XAP-MBA-DSD does not contain authorization checks for verifying an authenticated user's authorization to access some of its functions. This may lead to undesired system behavior.

Solution

A call to a generic BAdI for the authorization check has been added to the following function modules:

• /DSD/PE_CLEAN_CONDITIONS
• /DSD/PE_CON_SET
• /DSD/PE_KEY_MOD
• /DSD/PE_PRI_SPE

If an active BAdI implementation exists in a customer system and triggers the exception NO_AUTHORITY, access to data provided by these function modules will be restricted, and an error will be returned. If no implementation exists or if the implementation does not trigger the NO_AUTHORITY exception, the system will execute the functions as normal.

This note also includes fixes for potential SQL Injection vulnerabilities when calling these Function Modules. It is recommended to implement this solution in your system and review the manual activities outlined below.

References

• 2078596 – Further improvements for RFC security
• 1230364 – DSD enhanced authorization check