WTY, A&D XSRF Protection for BSP Application, SAP security note 1515145

SAP security note 1515145, "WTY, A&D: XSRF Protection for BSP Application", is a note released on 14.12.2010. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

The XSRF protection provided by the BSP Framework is not adapted to the WTY and A&D dealer portals, which are BSP applications.

Solution

Implement the corrections attached to this note. These corrections are valid for releases up to Ehp4 (604 for EA-APPL). For Ehp5 (605 for EA-APPL) and higher, the corrections are not applicable as XSRF protection is enabled via the Workbench.

• Refer to SAP Note 1520324 for additional information and prerequisites. The corrections from this note are required before implementing SAP Note 1515145.
• Follow the correction instructions provided in this note. This will create the report /SAPDII/BSP_XSRF_PARAM_DII_WTY in your system.
• Execute the report /SAPDII/BSP_XSRF_PARAM_DII_WTY and specify a transport request number when prompted. The report will populate the BSPTEMPXSRFSTORE database table with entries for the adapted BSP applications.

Reason and prerequisites

The Warranty Dealer Portal and A&D Spare Parts portal execute certain functions by referencing specific URLs. An attacker can trick an authenticated user’s browser into making requests containing specific URLs and parameters, causing functions to execute with the user’s privileges. Potential attack vectors include Cross Site Scripting (XSS) attacks or presenting clickable links to victims.

References

• SAP Note 1540729 – ASU content for activating XSRF protection for BSP
• SAP Note 1520324 – Advance creation of XSRF information

Affected components

• EA-APPL versions 600, 602, 603, 604, 605