Missing authorization checks in RFC enabled function modules, SAP security note 2740951

SAP security note 2740951, "Missing authorization checks in RFC enabled function modules", is a note. Below are the symptom and SAP recommended solution.

Description

Symptom

The following function modules do not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges:

• COD_CONTRACT_CREATEFROMDAT
• COD_CUSTHIER_BTE_CHANGE
• COD_CUSTHIER_BTE_DELETE
• COD_REPLICATE_CONTRACT_OUT
• COD_REPLICATE_SALES_ORDER_OUT
• COD_SALESORDER_CREATEFROMDAT2
• COD_CONTRACT_SIMULATE
• COD_ERP_GET_DOC_FLOW
• COD_LORD_GET_PRINT_PREVIEW
• COD_SALESORDER_SIMULATE

Impacts of Missing Authorization Checks:

• Abuse of functionality restricted to specific user groups
• Unauthorized read, modify, or delete of restricted data

Solution

The correction involves:

1. Removing Remote-Enabled Flags: the following function modules will no longer be processed via RFC calls:

• COD_CONTRACT_CREATEFROMDAT
• COD_CUSTHIER_BTE_CHANGE
• COD_CUSTHIER_BTE_DELETE
• COD_REPLICATE_CONTRACT_OUT
• COD_REPLICATE_SALES_ORDER_OUT
• COD_SALESORDER_CREATEFROMDAT2

2. Implementing Authority Checks: authority checks will be enforced on sales area (V_VBAK_VKO) and sales document type (V_VBAK_AAT) for:

• COD_CONTRACT_SIMULATE
• COD_ERP_GET_DOC_FLOW
• COD_LORD_GET_PRINT_PREVIEW
• COD_SALESORDER_SIMULATE

Implement the relevant support package or follow the attached correction instructions.

Reason and prerequisites

This issue occurs when integrating SAP Cloud for Customer with SAP ERP or S/4HANA.

CVSS

Score 6.3 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References

• Related SAP Note 2697949