Unauthorized usage of application functionality in IACs, SAP security note 1519052

SAP security note 1519052, "Unauthorized usage of application functionality in IACs", is released on December 14, 2010. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

A malicious user can trigger functionality in Internet Application Components (IAC) within the Logistics Execution > Shipping (LE-SHP) area without proper authentication and authorization. This vulnerability allows unauthorized execution of functions by manipulating specific URLs and parameters, potentially exploiting Cross-Site Request Forgery (XSRF) or Cross Site Scripting (XSS) attacks to carry out the exploit.

Solution

Ensure that Note 1481392 is implemented, as it contains additional information and instructions necessary for applying this security note.

• Apply the correction instructions attached to this note. These instructions will generate the report ITS_XSRF_PARAM_LE_602 in your system. Access the correction instructions here.
• Run the report ITS_XSRF_PARAM_LE_602 and specify the appropriate transfer order number if required. This report will add service parameters for the adjusted ITS services. You can maintain these settings using the GUI configuration pushbutton for a service with transaction SICF.

Affected components

• SAP_APPL: 500, 600, 602, 603, 604, 605