Positive lists for RFC callback, SAP security note 1686632

SAP security note 1686632, "Positive Lists for RFC Callback". Below are the symptom and SAP recommended solution.

Description

Symptom

When using a synchronous RFC in ABAP, function modules can potentially execute remote-enabled modules in the context of the RFC caller. This is only possible if the caller has the necessary RFC authorizations and the callback hasn’t been prohibited by RFC_CALLBACK_REJECTED (see SAP Note 1515925).

Solution

There are two solutions based on your SAP_BASIS and Kernel versions:

a) For SAP_BASIS 7.00 and later with Kernel 7.21 or higher:

• Implement configurable whitelists: Determine required configuration through the log mechanism.
• Configuration: Adjust the dynamic profile parameter rfc/callback_security_method with values ranging from 0 (Emergency mode) to 3 (Most secure mode).
• Additional Steps:
  • Create necessary ABAP Dictionary objects.
  • Apply manual activities as per the correction instructions.

b) For SAP_BASIS 6.20 and 6.40 with Kernel 6.40, or SAP_BASIS 7.00 to 7.31 with Kernel 7.20:

• Modify program source code: Whitelisting via configuration is not possible; source code modifications are required.
• Configuration: Adjust the dynamic profile parameter rfc/reject_callback with values 0 to 2 to control RFC callback behavior.

Prerequisites: Ensure that your system meets the following kernel requirements before applying the solutions:

• Solution A: Kernel with at least patch levels 7.21 SP 321, 7.41 SP 044, or 7.42 SP 009.
• Solution B: Kernel with at least patch levels 6.40 SP 422 or 7.20 SP 217.

Implementing these measures will significantly reduce the risk of unauthorized RFC callbacks, strengthening the security posture of your SAP environment.

CVSS

Score 6.0 Vector: AV:N/AC:M/AU:S/C:P/I:P/A:P

References

• SAP Note 2102941 – Update 1 to Security Note 1686632
• SAP Note 2058946 – Maintenance of callback positive lists before Release 7.40
• SAP Note 2002096 – Wrong originally called function in RFC callback check
• SAP Note 1968729 – SAL: Message definition for RFC callback
• SAP Note 1515925 – Preventing RFC callbacks during synchronous RFC