SAP security note 2028525, “Missing Authorization Check in FI-LA”, is a note. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
The function module FILA_PRODUCT_READ does not perform the necessary authorization checks, which may allow users to execute operations without the required permissions.
Solution
To mitigate this vulnerability, apply the correction instructions provided in the security note.
Reason and prerequisites
Remote calls to RFC function modules are typically protected by the authorization object S_RFC. However, in this case, FILA_PRODUCT_READ might not sufficiently enforce authorization checks, leading to potential security breaches. It’s essential to ensure that authorizations for S_RFC are tightly controlled and that additional functional authorization checks are implemented where necessary.
Affected components
- EA-APPL: 600, 602, 603, 604, 605, 606, 616, 617
Full note on SAP: SAP Support Launchpad note 2028525
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
