Missing authorization & hard-coded credentials, SAP security note 1495097

SAP security note 1495097, “Missing authorization & hard-coded credentials”, is a program error note released on 06.02.2012. Below are the symptom and SAP recommended solution.

Description

Symptom

1. An authenticated user can use functionality of the following programs to which access should be restricted. This can potentially result in an Escalation of Privileges:

• FIUT_180_APAR
• FIUT_180_BALDOC
• TFC_ADJUST_VZ

2. FICNEW00 contains code which changes the program’s behavior when a user successfully authenticates with a certain user name.

Solution

Apply support package or correction instructions.

• Authority checks have been added to the program logic.
• Program is obsolete and has been deactivated.

Reason and prerequisites

1. The programs lack permission checks for an authenticated user’s authorization to access some of its functionality. This may result in undesired system behavior.

2. The program code contains a hard-coded username which changes the system’s behavior if a user authenticates successfully.