Missing authorization check in CRM-BTX, SAP security note 2246269

SAP Note 2246269

SAP security note 2246269, "Missing authorization check in CRM-BTX". Below are the symptom, reason and prerequisites and SAP recommended solution.

Description

Symptom

An authenticated user can use functions of CRM-BTX to which access should be restricted. This may result in an escalation of privileges.

Solution

Implement a support package or apply correction instructions. Additionally, the RFC user calling into the CRM system must have the following authority object to display sales order information:

Authority Object CRM_ORD_LP, ID CHECK_LEV, FIELD *
Authority Object CRM_ORD_LP, ID PR_TYPE, FIELD display transactions
Authority Object CRM_ORD_LP, ID ACTVT, FIELD 03

Reason and prerequisites

CRM-BTX does not contain authorization checks for verifying an authenticated user’s authorization to access certain functions. This may result in undesired system behavior.

Full note on SAP: SAP Support Launchpad note 2246269

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Authorization #Authorization Check #CRM-BTX