Cross-site request forgery protection for BSP, SAP security note 1458171

SAP security note 1458171, “Cross-site request forgery protection for BSP”. Below are the SAP recommended solution and the affected software components.

Description

Solution

SAP Note 1458171 addresses Cross-Site Request Forgery (CSRF/XSRF) protection for Business Server Pages (BSP) applications. CSRF is a prevalent attack targeting web applications by exploiting authenticated user sessions. This note provides a comprehensive protection scheme to safeguard BSP applications against such vulnerabilities.

The protection mechanism is based on the secure token method, where each request sent to the server includes a unique token that cannot be easily guessed by attackers. This token is a 128-bit random number generated on the SAP application server and is typically injected into the page via JavaScript.

Steps to secure BSP services:

• Enable XSRF protection:
  • Action: switch on the XSRF protection flag for the BSP service.
  • Effect: the BSP runtime will validate secure tokens for all pages not marked as “Start pages.” Missing or invalid tokens will result in immediate session termination.
• Manual token handling:
  • Scenario: when URLs are constructed and launched via JavaScript.
  • Action: manually add the SESSION_TOKEN parameter using the GET_TOKEN method from the CL_BSP_RUNTIME class. var token = CL_BSP_RUNTIME.GET_TOKEN(); var url = "your_url_here&SESSION_TOKEN=" + token;
• Define start pages:
  • Purpose: identify pages that are safe and do not alter the system’s state.
  • Action: mark these pages as “Start pages” in the SE80 transaction or by editing the BSPTEMPXSRFSTORE table via SE16 if using the correction instruction.
• Single page applications:
  • Challenge: distinguishing safe from unsafe pages is not feasible.
  • Solution: set the single controller page as a “Start page” and implement runtime validation using CL_BSP_RUNTIME->VALIDATE_TOKEN and CL_BSP_RUNTIME->ABORT_DUE_TO_FALSE_TOKEN.
• Handling HTML reset buttons:
  • Issue: resetting forms clears hidden fields, including the secure token.
  • Solution: add the InitializeFormsDelayed() JavaScript method to the onclick handler of reset buttons to restore token values. <input type="reset" onclick="oSAPSecu.InitializeFormsDelayed();" />

SAP strongly recommends applying the relevant support packages to enable XSRF protection seamlessly. If applying support packages isn’t feasible, you can import transport files from SAP Note 1532403. However, be aware that using transport files may limit your ability to apply future SNOTE corrections for the imported objects unless you update to the recommended support packages.

If you have custom-developed BSP services, it’s imperative to follow the steps outlined in this note to protect your applications against CSRF attacks. SAP recommends assessing your BSP applications and implementing the necessary security measures as detailed above.

CVSS

Score 0

References

• 1666244 – cFolders: Composite SAP Note – Security
• 1540729 – ASU content for activating XSRF protection for BSP
• 1511193 – XSRF protection for the CCMS Monitoring Console
• 1510064 – Unauthorized usage of appl. functionality in PA-EC, PA-CP
• 1509014 – Unauthorized usage of application functionality in PA-ER
• 1491496 – Improved connection of logical transport objects

Affected components

• SAP_BASIS 620 to 640
• SAP_BASIS 700 to 702
• SAP_BASIS 710 to 730