SAP security note 2233831, "Switchable authorization checks for RFC in Leasing / Account Origination". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
This SAP note introduces new switchable authorization checks for RFC function modules in Leasing and Account Origination within the CRM component. Remote calls to RFC function modules are secured by the S_RFC authorization object, ensuring that only users with the necessary permissions can execute these functions. However, it has been identified that S_RFC checks alone may not be sufficient for secure execution of certain RFC function modules covered by this note. To address this, new authorization checks have been implemented and are delivered as inactive to maintain compatibility with existing processes. These checks can be activated manually using transaction SACF.
Solution
New switchable authorization checks have been implemented and can be activated through transaction SACF.
- Start transaction SACF and verify if the scenario definition CRM_FS_1 exists; if not, download the CRM_FS_1.txt file attached to this note and upload it via SACF_TRANSFER, assigning it to the development package CRM_LEASING_TOOLS
- Navigate to transaction SACF, select the scenario definition CRM_FS_1, and mark it as Active (activates the authorization check and logging to the Security Audit Log) or Logging (identifies users needing additional authorizations without enforcing the check)
- Ensure the Security Audit Log is activated in transaction SM19 and activate message IDs DUO, DUP and DUQ for auditing authorization checks
- Use report RSAU_SELECT_EVENTS to identify users requiring additional authorizations and update user roles accordingly
References
Affected components
- BBPCRM 700 to 714
Full note on SAP: SAP Support Launchpad note 2233831
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
