SAP security note 2027682, “EAM: RFC capability in component CS-SE-FS”, is a program error note released on 11.11.2014. Below is the security information published by SAP for this note.
Description
#### Symptom The function modules PM_CLUSTER_CREATE and IWWO_SERVORDER_CONFIRM are RFC capable. However, calling them from external systems is not intended.
#### Reason and Prerequisites This behavior is due to the system design, which allows these RFC calls internally but not externally.
#### Solution Implement the correction instructions provided in the note. After applying the corrections, only internal RFC calls will be possible.
References
- SAP Note 2078596 – Further improvements for RFC security
- SAP Note 1882417 – External check for Remote Function Call
Full note on SAP: SAP Support Launchpad note 2027682
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
