Missing authorization checks in CRM Portal Content function modules, SAP security note 2257328

SAP security note 2257328, "Missing authorization checks in CRM Portal Content function modules", is a program error note released on 11.10.2016. Below are the symptom, reason and prerequisites, SAP recommended solution and the affected software components.

Description

Symptom

This SAP note describes new authorization checks for the following RFC function modules in CRM Portal Content:

• CRM_SERVICE_CONTRACTS_SEARCH
• CRM_SERVICE_PROCESSES_SEARCH
• CRM_SERVICE_SEARCH_LIST
• CRM_SERVICE_COMPLAINTS_SEARCH
• CRM_SERV_COMPLAINT_SEARCH_LDB
• CRM_SERVICE_CONFIRMATION_SERCH
• CRM_SEARCH_OPPORTUNITY
• CRM_SEARCH_FAVO_SALESDOCS

Solution

Maintain the proper user authorization for the following function modules:

• CRM_SERVICE_CONTRACTS_SEARCH – Auth. Object CRM_CO_SE, Param1 ACTVT=45
• CRM_SERVICE_PROCESSES_SEARCH – Auth. Object CRM_CO_SE, Param1 ACTVT=45
• CRM_SERVICE_SEARCH_LIST – Auth. Object CRM_CO_SE, Param1 ACTVT=45
• CRM_SERVICE_COMPLAINTS_SEARCH – Auth. Object CRM_CMP, Param1 ACTVT=45
• CRM_SERV_COMPLAINT_SEARCH_LDB – Auth. Object CRM_CMP, Param1 ACTVT=45
• CRM_SERVICE_CONFIRMATION_SERCH – Auth. Object CRM_CON_SE, Param1 ACTVT=45
• CRM_SEARCH_OPPORTUNITY – Auth. Object CRM_OPP, Param1 ACTVT=45
• CRM_SEARCH_FAVO_SALESDOCS – Auth. Object CRM_SAO, Param1 ACTVT=45

Reason and prerequisites

Remote calls to RFC function modules are protected by checks on the authorization object S_RFC. Authorizations for S_RFC must be limited to the required minimum authorizations for all users to ensure system security. Many RFC function modules can be sufficiently protected using S_RFC authorization checks. These RFC function modules often do not perform additional functional authorization checks. Please see SAP note 2008727 for further information on RFC Security.

It was identified that S_RFC authorization checks might not be sufficient to ensure secure execution for RFC function modules covered by this note.

CRM Portal Content does not contain authorization checks for verifying an authenticated user’s authorization to access the mentioned function modules. This may result in undesired system behavior.

Affected components

• BBPCRM 700
• BBPCRM 701
• BBPCRM 702
• BBPCRM 712
• BBPCRM 713
• BBPCRM 714