Unreleased Internet Communication Framework services, SAP security note 626073

SAP security note 626073, “Unreleased Internet Communication Framework services”, is a program error note released on 13.10.2009. Below are the symptom, reason and prerequisites, SAP recommended solution and the related references.

Description

Symptom

Authorization checks are missing when you use Internet Communication Framework services that are intended for SAP-internal use only.

Solution

• Deactivate Unused Services: Go to transaction SICF. Deactivate the aforementioned services if they are not in use.
• Apply Corrections: Import the relevant Support Packages for Release 610 or 620. Alternatively, implement the necessary ABAP source code according to the specified correction instructions.

Reason and prerequisites

Some authorization checks are missing when you use the following generic Internet Communication Framework (ICF) services, which are intended for SAP-internal use ONLY:

• Service /sap/bc/report: This service checks the authorization group of the report to be executed. After implementing this correction, the service also checks the availability of an authorization group for each report to be called. If the report does not have an authorization group, the system issues an error message. When executing this service for transactions, it performs the authorization check for the transaction code. As of Release 711, this service is no longer available.
• Services /sap/bc/xrfc, /sap/bc/xrfc_test, and /sap/bc/FormToRfc: When executing remote-enabled (RFC) function modules, the service carries out the authorization check for the corresponding function groups by default. For more information, see Note 93254. As of Release 6.20, the service soap (/sap/bc/soap/rfc) handles the tasks of these services. For more details, refer to Notes 566955 and 1394100.
• Service /sap/bc/echo: Returns content of cookies, form fields, and header fields contained in the request and response objects as an HTML page. If cross-site scripting (XSS) is used in the request object, the script output as an HTML page can cause the script to be executed on the client host. This issue is resolved with the corresponding Support Packages for Release 610 and Release 620.
• Service /sap/bc/error: Allows reproduction of various error scenarios such as processing error messages of different types (S, E, A, X) in ABAP. Script parameters used (e.g., <%=PATHTRANS%>) may cause problems related to cross-site scripting (XSS). This issue is resolved by HTML escaping the relevant script parameters in the error document body for the corresponding releases.

As of Release 6.20, ICF services are delivered as inactive by default. For Release 6.10, you can deactivate unused services by assigning an invalid character string as an SAP authorization in the corresponding ICF service (e.g., “report” or “xrfc”) if the users do not have any generic S_ICF authorizations (‘*’). These services will soon be deleted from the ICF service tree.

References

• 93254 – RFC short dump RFC_NO_AUTHORITY
• 711701 – Composite SAP note: Security in E-Recruiting
• 566955 – SOAP Processor within SAP Web AS released
• 481543 – Disabling HTTP services in WebAS 6.10
• 1394100 – Security note: Access to RFC-enabled modules via SOAP