Skip links
RedRays - Your SAP Security Solution
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

SAP Security on Udemy

Missing authorization checks in function modules related to CRM knowledgebases for configurable products, SAP security note 2271018

SAP Note 2271018

SAP security note 2271018, "Missing authorization checks in function modules related to CRM knowledgebases for configurable products". Below are the symptom, reason and prerequisites and SAP recommended solution.

Description

Symptom

This security note identifies missing authorization checks in the following RFC function modules for CRM Configuration Knowledgebases:

  • COM_PME_GET_NEW_IDS
  • COM_PME_DB_INSERT_STABLE
  • COM_PME_DB_INSERT_KB_START
  • COM_PME_DB_INSERT_KB_END
  • COM_PME_DB_INSERT_CFGKB
  • COM_PME_DB_INSERT_VTABLE
  • COM_PME_DB_TRANS_START
  • COM_PME_DB_TRANS_ROLLBACK
  • COM_PME_DB_TRANS_COMMIT
  • CRM_SCE_DB_TRANS_INIT_RFC

Solution

To mitigate this issue, ensure that proper user authorizations are maintained for the affected function modules. Specifically, assign the following authorizations:

  • COM_PME_GET_NEW_IDS – Auth. Object COM_PRD, Param1 ACTVT=03
  • COM_PME_DB_INSERT_STABLE – Auth. Object COM_PRD, Param1 ACTVT=03
  • COM_PME_DB_INSERT_KB_START – Auth. Object COM_PRD, Param1 ACTVT=03
  • COM_PME_DB_INSERT_KB_END – Auth. Object COM_PRD, Param1 ACTVT=03
  • COM_PME_DB_INSERT_CFGKB – Auth. Object COM_PRD, Param1 ACTVT=03
  • COM_PME_DB_INSERT_VTABLE – Auth. Object COM_PRD, Param1 ACTVT=03
  • COM_PME_DB_TRANS_START – Auth. Object COM_PRD, Param1 ACTVT=03
  • COM_PME_DB_TRANS_ROLLBACK – Auth. Object COM_PRD, Param1 ACTVT=03
  • COM_PME_DB_TRANS_COMMIT – Auth. Object COM_PRD, Param1 ACTVT=03
  • CRM_SCE_DB_TRANS_INIT_RFC – Auth. Object COM_PRD, Param1 ACTVT=01

Reason and prerequisites

Remote calls to RFC function modules are protected by checks on the authorization object S_RFC. However, it was identified that these checks might not be sufficient for the mentioned function modules, potentially allowing unauthorized access and undesired system behavior. The CRM Product Master lacks necessary authorization checks for these functions.

References

  • SAP Note 1930885 – RFC-enabled function modules for copying a Knowledge Base

Full note on SAP: SAP Support Launchpad note 2271018

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#CRM #Authorization #RFC #Configurable Products

Explore More