SAP Security Note
Medium priority
SAP security note 2495462, "Switchable Authorization checks for RFC in SAP Leasing", is a note released on April 28, 2020. Below are the symptom and SAP recommended solution.
Description
Symptom
By default, RFC function modules are protected using the S_RFC authorization object. However, this level of protection may not be sufficient for all scenarios, potentially allowing unauthorized access or actions within the Lease Accounting Engine. This note addresses these gaps by introducing additional, switchable authorization checks.
Solution
- Switchable Authorization Checks:
- New authorization checks are implemented but remain inactive by default to maintain compatibility.
- Activation is performed manually via transaction SACF.
- Manual Pre-Implementation Steps:
- Check Existing Authorization Objects: Use transaction SU21 to verify if the authorization object F_L_ACCRUL exists.
- Create Authorization Fields: In transaction SU20, create new authorization fields: LA_COMP, BUKRS, ACCRULE, and ACTVT.
- Define New Authorization Object: Create F_L_ACCRUL in transaction SU21 with the newly created fields.
- Regenerate Authorizations: Regenerate SAP_ALL to incorporate the new authorization settings.
- Activation of Authorization Checks:
- Use transaction SACF_TRANSFER to upload the scenario definition from the attached SACF_DATA.TXT.
- Assign the scenario definition FI_LA to the development package FI_LA_GF.
- Activate the switchable authorization checks using transaction SACF_COMPARE post system updates.
All these function modules now require appropriate authorization via the F_L_ACCRUL object to ensure secure operations:
- FILA_BUS_TRANSACTION_RECEIVE
- FILA_PRODUCT_READ
- /LSIERP/TQ_GET_DETAILS
- FILA_ITEMS_PROCESS_NEW
- FILA_ITEMS_PROCESS
- FILA_ITEMS_PROCESS_ALL
- FILA_ITEMS_PROCESS_PACKAGE
- FIEH_EVENT_EXCEPTION_TRIGGER
- FIEH_EVENT_DONE_TRIGGER
CVSS
Score 6.3
References
Full note on SAP: SAP Support Launchpad note 2495462
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].