SAP Note 1657275
High priority
High priority
SAP security note 1657275, “Missing Authorization Check in FI-FM”, is a program error note released on 08.05.2012. Below are the symptom and SAP recommended solution.
Description
Symptom
An authenticated user can use functions of FI-FM to which access should be restricted. This may result in an escalation of privileges.
Solution
The correction is delivered in a Support Package. You have two options:
- Delete the view U_12424 if you agree to modify a dictionary repository object from SAP.
- Assign a table authorization group to the view U_12424 that is not authorized to anyone to prevent data from being accessed using transaction SE16 or similar. Use transaction SE54 (or SM30 for view V_DDAT_54) to assign the table authorization group SPWD. Ensure that no authorizations are provided for the authorization object S_TABU_DIS to any users or roles. You can use transaction SUIM to search for users or roles with authorizations for authorization object S_TABU_DIS.
Reason and prerequisites
FI-FM does not contain authorization checks for verifying an authenticated user’s authorization to access some of its functions. This may result in undesired system behavior.
Full note on SAP: SAP Support Launchpad note 1657275
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].