Missing authorization check in WEC-APP, SAP security note 2241871

SAP security note 2241871, "Missing authorization check in WEC-APP". Below are the symptom and SAP recommended solution.

Description

Symptom

An authenticated user can use functions of WEC-APP-* to which access should be restricted. This may result in an escalation of privileges.

Solution

Implement the support package or the correction instructions. The following function modules are enhanced with additional authorization checks:

• CRM_WEC_ESERV_IBASE_COMB_SRCH
• CRM_WEC_ESERV_IBASE_BP_READ
• CRM_WEC_ESERV_IBASE_COMP_READ
• CRM_WEC_ESERV_IBASE_GET_DETAIL
• CRM_WEC_GET_USER_PERS_DATA
• CRM_WEC_SAVE_USER_PERS_DATA
• CRM_WEC_ADDRESS_CHECK

For Web Channel Experience Management, SAP provides the example roles SAP_ERP_WEC_WU_ALL in ERP and SAP_CRM_WEC_WU_ALL in CRM. These roles contain the necessary authorization values. If you generate profiles on roles that do not inherit from the SAP example roles and encounter issues in WCEM after installing the note, please enhance your roles using transaction PFCG. For authorization object WEC_AUTH, maintain the field WEC_OBJ with value IBASE and the field ACTVT with value 03 for display. Similarly, for authorization object COM_WEC, maintain the field ACTVT with value 39 for check.

References

• 2066943 – New authorization check for RFC in component WEC-APP-UM
• 2008727 – Securing Remote Function Calls (RFC)

Affected components

• Web Channel Experience Management > Web Channel Applications > Web Channel Service (WEC-APP-SRV)