Missing authorization check in WebClient UI Framework, SAP security note 1575835

SAP security note 1575835, "Missing authorization check in WebClient UI Framework", is a program error note released on July 12, 2011. Below are the symptom and SAP recommended solution.

Description

Symptom

An authenticated user can use functions of the WebClient UI Framework to which access should be restricted. This may result in an escalation of privileges.

Solution

• Central User Administration (CUA) Configuration: the CUA is invoked via an RFC destination. SAP recommends always configuring the RFC destination to use the current user instead of a statically maintained user, so that all necessary authorization checks are performed in the CUA system with the current user’s credentials.
• Alternative setup (not recommended): if using the current user in the RFC destination is not feasible (e.g., local users don’t exist in the CUA system and you prefer not to create them), a statically maintained user can be used. This setup is not recommended by SAP.
• Local system checks: the corrections included in this note will verify if the current user has the authorization to assign PFCG roles to users.
• Prerequisite SAP Note: SAP Note 1557182 from SAP_BASIS is required before implementing these corrections.
• Import the corrections provided in this note. Be aware that there are manual steps that need to be processed post-import.

Reason and prerequisites

The WebClient UI Framework does not contain authorization checks for verifying an authenticated user’s permissions to access certain functions. This oversight can lead to undesired system behavior.

References

• 1282024 – CUA support for CRMD_UI_ROLE_ASSIGN (CRM-FRW-ROL)
• 1557182 – Downport: Method CL_SUSR_BASIC_TOOLS=>AUTH_CHECK_BY_BNAME (BC-SEC-USR-ADM)