SAP security note 1507298, "RWB alert configuration: Unauthorized executing of functions", is a program error note released on 14.12.2010. Below are the symptom and SAP recommended solution.
Description
Symptom
A malicious user can trigger functionality in the application Runtime Workbench – Alert Configuration without authentication and authorization.
Solution
Implement the attached correction instructions or import the relevant Support Package. Note the following:
- Read Note 1520324 for additional information and further instructions. The corrections from Note 1520324 are a prerequisite for implementing this note.
- Implement the correction instructions contained in this note. In this case, the program
BSP_XSRF_PARAM_BC_XI_IS_WKBis created in your system. - Execute the program and select the transport request when prompted. The program makes the relevant entries for the BSP applications that are adjusted with this note in the database table
BSPTEMPXSRFSTORE.
Reason and prerequisites
The alert configuration in the RWB executes certain functions through referencing specific URLs. When an attacker tricks an authenticated user’s browser into making a request containing a certain URL and specific parameters, functions of the alert configuration in the RWB are executed with the rights of the user. If present, the attacker may use a Cross Site Scripting attack to trigger the exploit, or use an approach in which a link to click is presented to the victim.
CVSS
Score 0
References
This note refers to
Full note on SAP: SAP Support Launchpad note 1507298
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].