SAP Security Note
Low priority
SAP security note 587410, "Test environment: Activity 16 (Execute) in S_DEVELOP", is an advance development note released on 08.10.2009. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
Users cannot execute any function modules in the Function Builder (transaction SE37) (as of Basis Release 6.40).
Solution
If you need to implement this change for BASIS Releases lower than Release 6.40, follow these correction instructions:
- Change SAP source code by following the attached correction instructions. Note: Support Packages or upgrades may overwrite source code changes.
- Adjust profiles and roles: identify profiles and roles with the S_DEVELOP object and '03' activity without '*', and assign the '16' Execute activity where necessary.
Detailed steps are provided within the note to guide through the adjustment process using transaction SUIM.
Reason and prerequisites
Due to several customer requests and changes in legal regulations, the authorization check in transaction SE37 (Function Builder) has been changed beginning with BASIS Release 6.40.
Previous behavior: users with authorization for the S_DEVELOP authorization object, '03' activity ("Display") could display and execute function modules. New behavior: the '03' activity now only allows displaying function modules; execution requires the new '16' activity ("Execute").
This change enhances security by allowing more specific authorization controls for executing function modules. Existing authorizations with '*' for activities remain unaffected. Adjusting roles and profiles to include the '16' activity is necessary to restore execution capabilities.
References
- Authorization/test of function modules
- Update #1 for Note 587410: Missing Authorization Check SE37
- Check for S_DEVELOP when executing function modules
- Authorization check when you test function modules 6.20
Affected components
- SAP_APPL: 40B to 45B
- SAP_BASIS: 46B to 46D, 610 to 640
Full note on SAP: SAP Support Launchpad note 587410
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
