SAP security note 2276488, "Missing authorization check in CRM-IC-HCM". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
This note introduces new authorization checks for the following RFC function modules in the HCM Shared Service Framework:
- CRM_IC_SSC_FILL_PA_INFO
- CRM_IC_SSC_CHKLIST_STEP_COMPLT
- CRM_IC_SSC_EC_SWITCH_STATUS
Solution
Ensure that the proper user authorizations are maintained for the following function modules:
- CRM_IC_SSC_FILL_PA_INFO, authorization object CRM_ORD_OP, ACTVT=03
- CRM_IC_SSC_CHKLIST_STEP_COMPLT, authorization object CRM_ORD_OP, ACTVT=03
- CRM_IC_SSC_EC_SWITCH_STATUS, authorization object CRM_ORD_OP, ACTVT=03
Reason and prerequisites
Remote calls to RFC function modules are protected by checks on the authorization object S_RFC. However, it was identified that these checks might not be sufficient to ensure secure execution for the mentioned function modules.
Affected components
- BBPCRM 713
- BBPCRM 714
- BBPCRM 715
Full note on SAP: SAP Support Launchpad note 2276488
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].