Skip links
RedRays - Your SAP Security Solution
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

SAP Security on Udemy

Missing authorization check in RFC function module, SAP security note 2432578

SAP Note 2432578SAP Security NoteMedium priority

SAP security note 2432578, “Missing authorization check in RFC function module”, is a note released on September 4, 2017. Below are the symptom and SAP recommended solution.

ComponentIndustry-Specific Components > Utilities > Deregulation / Liberalization > Germany > Intercompany Data Exchange German Common Layer
PriorityCorrection with medium priority
TypeSAP Security Note
Version5
StatusReleased for Customer
Released onSeptember 4, 2017

Description

Symptom

Market Process Management for Utilities (MPM) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.

Impacts of Missing Authorization Check:

  • Abuse functionality restricted to a specific user group
  • Read, modify, or delete restricted data

Solution

Please implement the correction instructions provided in the SAP Note.

Reason and prerequisites

No authority check within RFC.

References

Full note on SAP: SAP Support Launchpad note 2432578

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Access control#Authorization error#Authorization profile

Explore More