SAP security note 2740951, "Missing authorization checks in RFC enabled function modules", is a note. Below are the symptom and SAP recommended solution.
Description
Symptom
The following function modules do not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges:
- COD_CONTRACT_CREATEFROMDAT
- COD_CUSTHIER_BTE_CHANGE
- COD_CUSTHIER_BTE_DELETE
- COD_REPLICATE_CONTRACT_OUT
- COD_REPLICATE_SALES_ORDER_OUT
- COD_SALESORDER_CREATEFROMDAT2
- COD_CONTRACT_SIMULATE
- COD_ERP_GET_DOC_FLOW
- COD_LORD_GET_PRINT_PREVIEW
- COD_SALESORDER_SIMULATE
Impacts of Missing Authorization Checks:
- Abuse of functionality restricted to specific user groups
- Unauthorized read, modify, or delete of restricted data
Solution
The correction involves:
1. Removing Remote-Enabled Flags: the following function modules will no longer be processed via RFC calls:
- COD_CONTRACT_CREATEFROMDAT
- COD_CUSTHIER_BTE_CHANGE
- COD_CUSTHIER_BTE_DELETE
- COD_REPLICATE_CONTRACT_OUT
- COD_REPLICATE_SALES_ORDER_OUT
- COD_SALESORDER_CREATEFROMDAT2
2. Implementing Authority Checks: authority checks will be enforced on sales area (V_VBAK_VKO) and sales document type (V_VBAK_AAT) for:
- COD_CONTRACT_SIMULATE
- COD_ERP_GET_DOC_FLOW
- COD_LORD_GET_PRINT_PREVIEW
- COD_SALESORDER_SIMULATE
Implement the relevant support package or follow the attached correction instructions.
Reason and prerequisites
This issue occurs when integrating SAP Cloud for Customer with SAP ERP or S/4HANA.
CVSS
Score 6.3 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
References
Full note on SAP: SAP Support Launchpad note 2740951
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].