Missing authorization check in AutoID Mobile applications, SAP security note 1724623

SAP security note 1724623, "Missing authorization check in AutoID Mobile applications", is a note. Below are the symptom and SAP recommended solution.

Description

Symptom

An authenticated user can use functions of the AutoID Mobile application to gain access to device groups that should be restricted. This may result in an escalation of privileges.

Solution

To address this issue, implement the following correction instructions:

• Create a new Authorization Field: start transaction SU20, click Create (Shift+F4), enter Field Name /AIN/DEVGR, Data Element /AIN/DM_DEVGRP_ID, Table Name /AIN/DM_DEVGRP, then save. If prompted for a package, enter package /AIN/UI.
• Create a new Authorization Object: start transaction SU21, click Create > Authorization Object, enter Object /AIN/DEVGR, Text “Authorization to use Device Group”, Class AIN, Authorization Field /AIN/DEVGR, then save. If prompted for a package, enter package /AIN/UI.
• Create a new Message: start transaction SE91, enter Message Class /AIN/UI, click Change (F6), select Message number 514, enter Message Shorttext “Error: Device Group &1 is not authorized for user &2”, tick the checkbox SelfExplanatory = X, then save.
• Implement the Default Authorization Values: download the attached file SU22_mobile1.TXT and follow the instructions in related note 368496 using the downloaded file.

CVSS

Score 5.5 Vector: AV:N/AC:L/AU:S/C:P/I:P/A:N