Switchable Authorization checks for RFC in SRM, SAP security note 2528799

SAP security note 2528799, "Implementing Switchable Authorization Checks for RFC in SRM". Below are the symptom and SAP recommended solution.

Description

Symptom

Remote calls to RFC function modules in SRM were found to have inadequate authorization checks using the S_RFC authorization object. This vulnerability could allow unauthorized execution of RFC function modules, potentially compromising system security.

Solution

The note implements new switchable authorization checks delivered inactive to maintain compatibility. These can be activated manually via transaction SACF. The key steps include:

• Upload Scenario Definitions: Use transaction SACF_TRANSFER to upload scenario definitions from the attached .TXT files.
• Activate Authorization Scenarios: In transaction SACF, transfer scenario definitions to productive scenarios and set their status to "Active" or "Logging". "Active" status enables the authorization checks and logs them to the Security Audit Log. "Logging" status logs the checks without enforcing them, allowing identification of required authorizations.
• Adjust User Roles: Update user roles to include the necessary authorizations based on the new scenarios.
• Activate Security Audit Logging (Optional): Ensure Security Audit Log is active in transaction SM19. Activate relevant message IDs (DUO, DUP, DUQ) for detailed logging.

The implementation affects various business processes and roles that utilize RFC function modules across Contract Management, Invoice Management, Material Management, Purchase Requisition, Reservation Management, Vendor Management and Financial Document Display.

Reason and prerequisites

The default S_RFC authorization checks were not sufficient for securing the execution of certain RFC function modules within SRM. To mitigate this, new switchable authorization checks are necessary. Before applying this note, ensure that the following prerequisite notes are implemented:

• 1995667 – SACF: Navigation error
• 1882417 – External check for Remote Function Call
• 1988903 – Check whether a function modules was called via external RFC
• 2008372 – SU22: Error uploading default values
• 2449051 – SACF | Documentation of scenarios

CVSS

Score 6.3 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References

• SAP Note 2777772 – Shopping cart transfer issue
• SAP Note 2622718 – SRM calls to back-end ECC system don’t return requested data