SAP security note 1509378, "Unauthorized Usage of Application Functionality in BSP ALRTPERS". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
A malicious user can trigger functionality in the Business Server Page (BSP) ALRTPERS without authentication and authorization.
Solution
- Apply Prerequisite Note: Implement SAP Note 1520324, which provides advance creation of XSRF information. This note is a prerequisite for implementing SAP Note 1509378.
- Implement Correction Instructions: Use the Note Assistant or import the relevant Support Package to apply the corrections from this note. This process will create the report BSP_XSRF_PARAM_BC_SRV_GBT_ALM in your system.
- Execute the Report: Run the report BSP_XSRF_PARAM_BC_SRV_GBT_ALM and enter a transport request if necessary. This report inserts the relevant entries for the BSP application into the BSPTEMPXSRFSTORE database table.
Reason and prerequisites
The BSP ALRTPERS executes certain functions through specific URLs. An attacker can trick an authenticated user’s browser into making a request with certain URLs and parameters, executing functions with the user’s rights. This can be exploited via Cross Site Scripting (XSS) or by presenting a clickable link to the victim.
Affected components
- SAP_BASIS 620 to 730
Full note on SAP: SAP Support Launchpad note 1509378
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].