Missing authorization checks for RFC in E-commerce ERP applications, SAP security note 2029397

SAP security note 2029397, “Missing authorization checks for RFC in E-commerce ERP applications.” Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

This SAP note describes information related to new authorization checks added to RFC function modules used in E-commerce applications with ERP scenarios.

Solution

The following new functional authorization objects have been added to the function modules below:

• ISA_CUSTOMER_GETSALESAREAS – Create List of Sales Areas for the Customer via RFC. Access to customer’s sales area data with authority checks on objects F_KNA1_GEN and V_KNA1_VKO.
• ISA_CUSTOMER_SALES_READ – Read from sales area data for customers via RFC. Similar authority checks as above.
• ISA_FIND_CUSTOMER_PROCEDURE – Read the customer schema via RFC. No longer supported; coding is commented out.
• ISA_FIND_PRICING_PROCEDURE – Determine the pricing procedure via RFC. Authority checks on F_KNA1_GEN and V_KNA1_VKO.
• ISA_GET_CATALOG_LIST – Read Catalog List and language via RFC. Authority check on ISA_AUCT.
• ISA_GET_PRODCAT_ITEMS_BY_MATNR – Read product Catalog and material data via RFC. No longer supported; coding is commented out.
• ISA_GET_VARIANT_LIST – Reads product catalog variants based on language. Authority check on ISA_AUCT.
• ISA_INTERNET_USER – Used for SU05 user creation/change via RFC. Authority checks on F_KNA1_GEN, S_USER_GRP.
• ISA_READ_CONTACT_IDENTIFIER – Read identifier of contact person via RFC. Authority check on ISA_LRD. Important: view the manual implementation steps attached to the correction instructions for release 604 and higher.
• ISA_READ_CUSTOMER_IDENTIFIER – Read identifier of customer via RFC. Authority check on ISA_LRD. Important: view the post implementation steps attached to the correction instructions for release 604 and higher.
• ISA_SHIPTOS_OF_SOLDTO_GET – Goods Recipient for Client via RFC. Authority checks on V_KNA1_VKO and F_KNA1_GEN.
• ISA_USER_GET_FROM_CUSTOMER – Read user attached to customer via RFC. Authority check on F_KNA1_GEN.
• IST_GET_CHARACTERISTICS – Read product Catalog data per customer via RFC. No longer supported; coding is commented out.
• IST_SET_CHARACTERISTICS – Sets the product Catalog data per customer via RFC. No longer supported; coding is commented out.
• IST_CLEAR_CHARACTERISTICS – Deletes the product Catalog data per customer via RFC. No longer supported; coding is commented out.
• ADV_MED_READ_RFC – Reads product catalog data via RFC. Authority check on W_PCAT_MTN.
• ADV_MED_VARIANTS_READ – Reads product catalog variant data via RFC. Authority check on W_PCAT_MTN.

Reason and prerequisites

Remote calls to RFC function modules are protected by checks on the authorization object S_RFC. Authorizations for S_RFC must be limited to the required minimum authorizations for all users to ensure system security. Many RFC function modules can be sufficiently protected using S_RFC authorization checks. These RFC function modules often do not perform additional functional authorization checks. Please see SAP Note 2008727 for further information on RFC Security. It was identified that S_RFC authorization checks might not be sufficient to ensure secure execution for RFC function modules covered by this SAP Note.

References

• SAP Note 2222068 – Incorrect authorization check
• SAP Note 2146487 – Internal Error :SAPLWWMM LWWMMF02 451 => call hotline

Affected components

• SAP_APPL: Versions 600 to 617