Switchable Authorization checks for RFC in FI-CA for Data Protection, SAP security note 2546300

SAP security note 2546300, "Switchable Authorization Checks for RFC in FI-CA for Data Protection", is a note. Below are the symptom, reason and prerequisites, SAP recommended solution, affected software components and references.

Description

Symptom

The standard S_RFC authorization checks may not adequately protect specific RFC function modules, potentially allowing unauthorized execution. This vulnerability affects the secure handling of data within the FI-CA module.

Solution

Implement the new switchable authorization checks as detailed in SAP Note 2546300. These checks are delivered inactive to maintain compatibility and can be activated manually using transaction SACF.

• Create Authorization Scenario Definition: start transaction SACF in the development system; check if the scenario definition FKK_DPP_TEST exists; if not, download the attached file FKK_DPP_TEST.txt from the SAP Support Portal; use transaction SACF_TRANSFER to upload the scenario definition; assign the scenario definition FKK_DPP_TEST to the development package FKK_PRIVACY.
• Activate Switchable Authorization Checks: use transaction SACF_COMPARE after system updates to activate the necessary authorization checks. Refer to SAP Note 1922808 for detailed instructions on activating the switchable authorization check framework.

Reason and prerequisites

While many RFC function modules are protected using S_RFC authorization checks, some do not perform additional functional authorization checks, leaving gaps in security. This note identifies the insufficiency of S_RFC checks for certain obsolete RFC function modules.

References

• SAP Note 2216306 – Recommended settings for profile parameter auth/rfc_authority_check
• SAP Note 2008727 – Securing Remote Function Calls (RFC)

Affected components

• FI-CA: Versions 617, 618, 800, 801
• S4CORE: Version 102
• RFC Function Modules Affected: FKKDPR_TEST_DEL_BP_SORT, FKKDPR_TEST_EXECUTE_6750, FKKDPR_TEST_READ_BP, FKKDPR_TEST_READ_BP_MAPPING, FKKDPR_TEST_UPD_BP