SAP security note 2213128, “Switchable authorization checks for RFCs in GBT integration component GBTRINT in ERP”. Below are the symptom and SAP recommended solution.
Description
Symptom
Remote calls to RFC function modules are currently protected by the authorization object S_RFC. However, this may not be sufficient to guarantee secure execution for certain RFC function modules covered by this note.
Solution
Activate switchable authorization checks: implement BAdI /GBTINT/EX_AUTHORITY_CHECK by copying the example implementation and activating it. Ensure that users have the new authorities before activation to prevent authorization issues.
Update user roles: enhance user roles with authorities from the corresponding SAP_GBTINT_RFC roles.
Reason and prerequisites
The existing S_RFC authorization checks might not fully secure the execution of RFC function modules in the GBT integration component. To address this, new authorization checks need to be activated, and corresponding roles must be updated.
References
Full note on SAP: SAP Support Launchpad note 2213128
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].