SAP security note 2429274, "Switchable Authorization checks in SAP Enterprise Financial Services". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
UPDATE 22nd September 2020: This note has been re-released with updated 'Solution' information. We added the note 2225225 as the pre-requisite in the correction instruction of this note.
This SAP note describes new switchable authorization checks for RFC function modules in SAP Deposits Management Suite Edition/SAP Deposits Management S/4HANA Edition.
Solution
New switchable authorization checks have been implemented. The checks are delivered inactive to ensure compatibility with your running processes. The checks can be activated in transaction SACF as described in the attached manual correction instruction. See note 1922808 for additional information on the switchable authorization check framework (SACF).
Reason and prerequisites
Remote calls to RFC function modules are by default protected by checks on the authorization object S_RFC. These checks must not be deactivated. See SAP Note 2216306 for recommended and deprecated settings of profile parameter auth/rfc_authority_check. Authorizations for S_RFC must be limited to the required minimum authorizations for all users to ensure system security. Many RFC function modules can be sufficiently protected using S_RFC authorization checks. These RFC function modules often do not perform additional functional authorization checks. Please see white paper "Securing Remote Function Calls (RFC)" which is also attached to SAP note 2008727 for further information on RFC Security.
It was identified that S_RFC authorization checks might not be sufficient to ensure secure execution for RFC function modules covered by this note. Activate new switchable authorization checks and update corresponding roles if these RFC function modules are included in S_RFC authorizations in your system.
CVSS
Score 6.3 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
References
Affected components
- SAPSCORE 110
- S4CORE 101
- EA-FINSERV 600, 603, 604, 605, 606, 616, 617, 618, 800
Full note on SAP: SAP Support Launchpad note 2429274
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].