Missing authorization check in IW_TNG, SAP security note 1534251

SAP security note 1534251, "Missing authorization check in IW_TNG". Below are the symptom and SAP recommended solution.

Description

Symptom

• An authenticated user can use functions of IW_TNG to which access should be restricted. This may result in an escalation of privileges.
• A security breach was found in the user subscription process.
• Failure to implement this note can lead to exposure of business data.
• This problem appears in all versions prior to Duet Enterprise SP02.

Solution

• This problem can be avoided by having the system reside behind a firewall.
• If the problem has already appeared, add an authorization object check to the user subscription service (authorization object S_USER_AGR, field ACTVT: ’03’).
• To check if this solution worked, try to enable the service with a user that has not been assigned the authorization object.

Reason and prerequisites

IW_TNG does not contain authorization checks for checking an authenticated user’s authorization to access some of its functions. This may result in undesired system behavior.

References

• 1465331 – Duet Enterprise 1.0 Workflow Information Note