Switchable authorization checks for RFC in Workflow and ESS, SAP security note 2044543

SAP security note 2044543, “Switchable authorization checks for RFC in Workflow and ESS”, is a note. Below is the security information published by SAP for this note.

Description

Symptom

This note introduces new switchable authorization checks for RFC function modules used in Workflow and ESS. Previously, remote calls to RFC function modules were protected solely by the S_RFC authorization object. However, it was identified that S_RFC checks alone might not ensure secure execution for certain RFC function modules.

Reason and prerequisites

• Authorization Object: Remote calls to RFC function modules are guarded by S_RFC. It's crucial to limit authorizations for S_RFC to the necessary minimum to maintain system security.
• Identified Issue: Some RFC function modules that are protected by S_RFC do not perform additional functional authorization checks, potentially exposing security vulnerabilities.

Solution

• New Authorization Checks: Implement new switchable authorization checks introduced in this note. These checks are initially inactive to ensure compatibility with existing processes.
• Activation Steps:

1. Technical Implementation: Apply the support package or correction instructions provided in the note to pre-implement the checks. 2. Manual Activation: Use transaction SACF to activate the authorization checks manually. Detailed instructions are provided in the Correction Instructions section of the note.

References

• 2078596 – Further improvements for RFC security
• 2148160 – Work item texts sporadically remain empty