SAP security note 1481392, "Cross Site Request Forgery Protection for ITS". Below are the symptom and SAP recommended solution.
Description
Symptom
Cross Site Request Forgery (XSRF) is an attack targeting web applications. This SAP note describes a generic protection scheme to safeguard ITS services against XSRF attacks. It is relevant if you are using SAP-provided ITS services or have developed custom ITS services.
Solution
To enable XSRF protection in ITS services:
Integrated ITS (Release Basis 6.40 and higher): in transaction SICF, navigate to the ITS service (typically under /sap/bc/gui/sap/its/<service>), select the "Service Data" tab, switch to change mode, open "GUI Configuration" and add the parameter ~XSRFCHECK with the value 1.
External ITS 6.20 (SAP Basis Release 4.6C and 6.20): in transaction SE80, Repository Browser, choose "Internet Service" and select the service, select the "Parameter" tab, and add the parameter ~XSRFCHECK with the value 1. For ITS 6.20, XSRF protection is not yet available; once the relevant patch is released, set the parameters as described.
The protection mechanism works as follows:
- A filter only permits allowed OK codes for IAC services as per SAP Note 1501768.
- JavaScript injects XSRF tokens into HTML pages.
- Server-side validation terminates sessions if requests lack the XSRF token.
If automatic insertion of the token fails, manually include it in URLs by adding the parameter ~SAP_SESSTOKEN=<token>, or in forms by adding a hidden input field named ~SAP_SESSTOKEN.
Full note on SAP: SAP Support Launchpad note 1481392
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
