SAP security note 1511049, “Unauthorized usage of application functionality in IS-HER-CM”, is a note. Below are the symptom, reason and prerequisites and SAP recommended solution.
Description
Symptom
A malicious user can trigger functionality in IS-HER-CM without authentication and authorization.
Solution
- Refer to Note 1481392 for additional information and instructions. The corrections from this note are a prerequisite for the implementation of this note.
- Implement the correction instructions of this note. This will also create the report
ITS_XSRF_PARAM_PMIQ_<release>in your system. - Execute the report
ITS_XSRF_PARAM_PMIQ_<release>and specify a corresponding transport request number when prompted. The report will add service parameters for the adapted ITS services (maintained via the GUI configuration pushbutton for a service within transaction SICF).
Reason and prerequisites
IS-HER-CM executes certain functions through referencing specific URLs. When an attacker tricks an authenticated user's browser into making a request containing a certain URL and specific parameters, the function is executed with the rights of the user.
If present, the attacker may use a Cross Site Scripting (XSS) attack to trigger the exploit, or use an approach in which a link to click is presented to the victim.
Full note on SAP: SAP Support Launchpad note 1511049
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
