SAP security note 1769064, “Additional values for auth/rfc_authority_check”, is a program error note released on 11.08.2014. Below is the security information published by SAP for this note.
Description
Symptom
An authenticated user can access function modules, especially those belonging to the SRFC function group, even though access to these function modules should be restricted by the S_RFC authorization check. This may result in an escalation of privileges.
Reason and prerequisites
The RFC runtime does not contain authorization checks for verifying an authenticated user’s authorization to access some of its functions. This may result in undesired system behavior.
Solution
The profile parameter auth/rfc_authority_check currently offers only basic options for differentiating system function modules. With the introduction of new values, you can set the access with finer granularity. It is now possible to define only RFC_PING or RFC_PING and RFC_SYSTEM_INFO as system modules without requiring a logon or an authorization check, instead of restricting the entire function group.
For more information, refer to the documentation of the profile parameter.
References
- SAP Note 2629803: Parameter auth/trfc_no_authority_check is unknown in RZ11
- SAP Note 2216306: S_RFC check and profile parameter auth/rfc_authority_check
Full note on SAP: SAP Support Launchpad note 1769064
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
