Missing Authorization check in SAP Yard Logistics, SAP security note 2317358

SAP security note 2317358, "Missing Authorization check in SAP Yard Logistics", is a program error note released on August 5, 2016. Below are the symptom and SAP recommended solution.

Description

Symptom

Function Modules /SAPYL/SET_YT_STATUS_ASYNC, /SAPYL/WS_DOOR_ARR_DEP, /SAPYL/WS_LOAD_UNLOAD_NOTIF, and /SAPYL/WS_QUERY_EXTERNAL_TU do not perform necessary authorization checks for authenticated users, resulting in escalation of privileges.

Impacts of Missing Authorization Checks:

• Abuse of functionality restricted to specific user groups.
• Unauthorized read, modify, or delete of restricted data.

Solution

An additional authorization object /SAPYL/SLF (SAP Yard Logistics Special Logistics Functions) has been introduced. This object is now checked at the RFC level, requiring the yard number and the specific logistical function as parameters.

Implemented Checks:

• Web Service Call for EWM Door Arrival and Departure: requires authorization for the yard number and door arrival (fixed value AR) or door departure (fixed value DP).
• Web Service Call for EWM Loading and Unloading Notification: requires authorization for the yard number and loading/unloading notification call (fixed value NF).
• Web Service Call for EWM Query for a Specific TU: requires authorization for the yard number and the TU query call (fixed value Q1).

Reason and prerequisites

Missing authorization checks in RFC Function Modules. This issue exclusively affects SAP Yard Logistics.