SAP Note 2262131
SAP security note 2262131, "Switchable authorization checks for RFC in CRM-MSA-ADP and CRM-MT-MAS-ARS". Below are the symptom and SAP recommended solution.
Description
Symptom
Remote calls to RFC function modules were previously protected by the S_RFC authorization object. However, it was identified that S_RFC checks might not suffice for secure execution. This note addresses this by introducing additional authorization checks.
Solution
New switchable authorization checks have been implemented and delivered as inactive to maintain compatibility.
- Create the new authorization object CRM_MC_DOE in transaction SU21 if it does not exist (class CDOE, package CRM_DATAEXCHANGE_MCA, field ACTVT allowing activity 45), then regenerate SAP_ALL
- Scenario CRM_MSA_ADP_DOE – used for handheld device sync with Mobile Clients, assigned to package CRM_DATAEXCHANGE_MCA
- Scenario CRM_MT_ARS – Transport Management Authorization, assigned to package MAR_TM
- If the scenarios do not exist, upload the respective TXT files via transaction SACF_TRANSFER
- Activate the switchable authorization checks following the steps in SAP Note 1922808
Full note on SAP: SAP Support Launchpad note 2262131
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
