XSRF activation in ITS Services, SAP security note 1522651

SAP security note 1522651, "XSRF activation in ITS Services". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

This security note addresses a Cross-Site Request Forgery (XSRF) vulnerability in the Supplier Relationship Management (SRM) system's ITS services. An attacker could exploit this vulnerability to perform unauthorized actions within the SRM system.

On SRM 4.0 (SRM_SERVER 500), the correction only works with the integrated ITS 6.40; external ITS 6.20 is not supported at this time.

Solution

• Implement the corrections from Note 1481392 as a prerequisite.
• Implement the correction instructions in this note, which create the report ITS_XSRF_PARAM_SRM in your system.
• Execute the report ITS_XSRF_PARAM_SRM, providing a transport request number when prompted; this adds the necessary service parameters for the adapted ITS services in transaction SICF.
• Apply the SRM correction either via the corresponding Support Package (SRM_SERVER 500: SAPKIBKS17; SRM_SERVER 550: SAPKIBKT18) or via SNOTE (requires at least SRM_SERVER 500/550 SP 15; lower SP releases might work but are not guaranteed).
• Additionally update SAP_ABA either via the corresponding Support Package (SAP_ABA 640: SAPKA64028; SAP_ABA 700: SAPKA70024) or via SNOTE code changes.

References

• 1536087 – Update #1 to security note 1522651
• 1536193 – Update #2 to security note 1522651
• 1518849 – SRM 5.0 SP stack 18(02/2011) SAPKIBKT18 release/info note

Affected components

• SRM_SERVER (500, 550)
• SAP_ABA (640, 700)