Missing Authorization check in SAP NetWeaver (ABAP Server), SAP security note 2822074

SAP security note 2822074, “Missing Authorization check in SAP NetWeaver (ABAP Server)”. Below are the symptom and SAP recommended solution.

Description

Symptom

UPDATE 10th March 2020: This note has been re-released with updated Solution information. We added the requirement to add a manual pre-installation step. This step is to check whether package SWO_TEST exists and create it if it does not exist.

UPDATE 28th January 2020: This note has been re-released with updated validity and Solution information. We restricted the validity of 740 instructions to SP12.

SAP NetWeaver (ABAP Server) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.

Some well-known impacts of Missing Authorization check are:

• Abuse functionality restricted to a particular user group
• Read, modify, or delete restricted data

Solution

By the correction provided in this SAP Note, new authorization objects S_BOR_RFC and S_BOR_PRX are created. The new authorization checks are switchable using transaction SACF and must be switched on to activate the check.

• Local use case, e.g., SAP Business Workflow: No change.
• RFC client use case, e.g., SAP Java Connector (JCo) as RFC client: a check for S_BOR_RFC is introduced and must be switched via scenario SWO_REMOTE_ACCESS on the RFC server-side.
• Remote use case with a logical system connecting two SAP Systems, e.g., SAP ERP and SAP CRM: a check for S_BOR_RFC is introduced and must be switched via scenario SWO_REMOTE_ACCESS in the target system of the logical system connection.
• Proxy use case: RFC client calls a system (proxy) to connect to another system (target) using a logical system (from proxy to target): in the proxy system, a check for S_BOR_PRX is introduced and must be switched via scenario SWO_PROXY_ACCESS; in the target system, a check for S_BOR_RFC is introduced and must be switched via scenario SWO_REMOTE_ACCESS.

Please implement the SAP Support Package mentioned in this SAP Note or the respective correction instruction.

Important: If you want to implement the correction instructions, you must implement SAP Note 2844646 in advance. Restart transaction SNOTE after implementing 2844646. Only after that can you implement this SAP Note.

After implementing the SAP Note, execute the report SWO_RFC_AUTH_CHECK_STATE to see if the scenario is active and to check whether the used kernel meets the requirements of this correction.

CVSS

Score 6.6 Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

References