Incorrect Authorization Checks in SAP ERP Logistics Customer Master and Vendor Master, SAP security note 2427949

SAP security note 2427949, "Incorrect Authorization Checks in SAP ERP Logistics Customer Master and Vendor Master", is a note. Below are the symptom, CVSS score, reason and prerequisites, SAP recommended solution and the affected software components.

Description

Symptom

UPDATE 17th January 2018: this note has been re-released with updated "Correction instructions" information.

SAP ERP Logistics Customer Master and Vendor Master performs incorrect authorization checks for an authenticated user, which may result in potential escalation of privileges. Some well-known impacts of incorrect authorization checks are:

• Abuse functionality restricted to a particular user group
• Read, modify, or delete restricted data

CVSS

Score 6.3/10 Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Reason and prerequisites

Remote calls to RFC function modules are protected by checks on the authorization object S_RFC. Authorizations for S_RFC must be limited to the required minimum authorizations for all users to ensure system security. Please see SAP note 2008727 for further information on RFC Security.

Prerequisite: Note 2179233 or corresponding support package is implemented.

Solution

New switchable authorization checks have been implemented. The checks are delivered inactive to ensure compatibility with your running processes. The checks can be activated in transaction SACF as described in the manual correction instructions.

Steps to activate switchable authorization checks:

• Create the Authorization Scenario Definition: start transaction SACF in the development system and check if scenario definitions LO_MD_BP_CREMAS (for vendor CREMAS idocs) or LO_MD_BP_DEBMAS (for customer DEBMAS idocs) exist. If they exist, proceed to the next step. If not, download the attachment LO_MD_BP_IDOC_TRX.TXT from this note, start transaction SACF_TRANSFER, select "Upload", choose "Scenario Definition", deselect "Productive Scenarios" and "Test Mode", execute (F8), select the file LO_MD_BP_IDOC_TRX.TXT and confirm the upload, then assign the scenario definitions LO_MD_BP_CREMAS and LO_MD_BP_DEBMAS to the development package VSV.
• Create the Productive Authorization Scenario: in transaction SACF, select "Scenario Definition" and the relevant scenario name, execute (F8), double-click the scenario definition and click "Scenario" (or press F5) to transfer it to a productive scenario, then choose the initial scenario status: Active (activates the authorization check and logs to the Security Audit Log) or Logging (activates logging only, allowing you to identify users needing the required authorizations without enforcing them immediately).
• Activate Logging in Security Audit Log: ensure Security Audit Log is activated by checking transaction SM19, Environment, Profile parameter (or the "Kernel Parameters" tab), create a new filter in the active Security Audit Log configuration for Other events – Non-Critical (DUO: Authorization check successful; DUP: Authorization check failed) and Other events – Critical (DUQ: Authorization scenario change), then activate the new filter.
• Adjust User Roles: use report RSAU_SELECT_EVENTS to identify users requiring new authorizations based on DUO and DUP audit messages, and analyze authorization checks using system trace transactions STAUTHTRACE or ST01.

References

• Note 2179233: Missing authorization check in LO-MD-BP-CM, LO-MD-BP-VM, FI-AP-AP-N, FI-AR-AR-N
• Note 2008727: Securing Remote Function Calls (RFC)

Affected components

• SAP_APPL: Versions 600 to 618
• S4CORE: Versions 100 and 101