SAP security note 1469368, "RMA: Authorization check missing in RMA workbench", is a note released on September 20, 2010. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
When the business function ISR_RETAIL_RMA is activated in ERP, the RMA workbench in the BW system lacks necessary authorization checks. This omission allows users to call functions without the required permissions, leading to potential unwanted changes in system behavior.
Solution
To resolve this issue, you can either apply the appropriate support packages or implement the provided correction instructions.
- Apply Support Packages: BI_CONT 7.05 Support Package 02, BI_CONT 7.04 Support Package 08.
- Additionally, define a secure RFC connection for synchronous method calls in ALE Customizing by following the Implementation Guide (IMG): SAP NetWeaver Application Server – Application Server – IDoc Interface / ALE – Communication – Determine RFC Destinations for Method Calls.
Affected components
- BI_CONT 7.04
- BI_CONT 7.05
Full note on SAP: SAP Support Launchpad note 1469368
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].