SAP security note 1507294, "Unauthorized usage of application functionality – SRM Catalog". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
A malicious user can trigger functionality in SRM-MDM Catalog without authentication and authorization.
Solution
The changes done for fixing XSRF related issues are available from SRM-MDM Catalog 7.01 SP02 Patch00. You can find SRM-MDM Catalog 7.01 SP02 Patch00 in the Support Package and Patch Area of the Service Marketplace.
Reason and prerequisites
SRM-MDM Catalog executes certain functions through referencing specific URLs. When an attacker tricks an authenticated user's browser into making a request containing a certain URL and specific parameters, the function is executed with the rights of the user.
If present, the attacker may use a Cross Site Scripting attack to trigger the exploit, or use an approach in which a link to click is presented to the victim.
References
Affected components
- SRM_MDM_CAT from version 2.0 onwards
- SRM_MDM_CAT from version 3.0 onwards
- SRM_MDM_CAT from version 7.01 onwards
- SRM_MDM_CAT from version 7.02 onwards
Full note on SAP: SAP Support Launchpad note 1507294
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].