Unauthorized usage of application functionality in WFM., SAP security note 1511031

SAP security note 1511031, “Unauthorized usage of application functionality in WFM”, is a note. Below are the symptom, reason and prerequisites, SAP recommended solution and references.

Description

Symptom

A malicious user can trigger functionality in CA-GTF-WFA (WFM) without proper authentication and authorization.

Solution

To address the XSRF vulnerability, apply the following steps included in the current Support Package:

• Apply XSRF Protection Framework: Ensure you have applied Note 1450166, which provides an overview and details on the XSRF Protection Framework for SAP NetWeaver Application Server Java (AS Java).
• Update configuration and JSP files: Download and copy the xsrf-config.xml file from the attachments into the /WEB-INF directory of your WFM application. Replace the existing JSP files with the updated versions provided in the attachments; these enhanced pages include tokens attached to state-critical actions either as URL parameters or hidden form fields. If you have customized JSP pages for branding or other purposes, manually integrate the token changes to ensure XSRF protection without losing your customizations.
• Handle custom or additional state-changing actions: Add any new actions to the xsrf-config.xml file as per the guidelines in Note 1450166, and ensure that all state-changing actions include the necessary URL parameters or hidden form fields to incorporate the XSRF tokens.

Affected SAP-delivered JSP pages in WFM (CA-GTF-WFA) requiring updates:

• swapshifts.jsp
• isv.jsp
• replacements.jsp
• scheduleevents.jsp
• startup.jsp
• ewsvpopup.jsp
• weeklyschedule.jsp
• scheduletrack.jsp
• corecoverage.jsp
• tasks.jsp
• Config.jsp
• ophours.jsp
• status.jsp
• /aslForecasting/forecast/forecastAdjust.jsp
• /aslForecasting/startup/startup.jsp
• /aslForecasting/workload/workloadAdjust.jsp
• /employee/pa/hire/pa.jsp
• /employee/pa/rehire/parehire.jsp
• /employee/pa/terminate/paterminate.jsp
• /employee/pa/transfer/patransfer.jsp
• /employee/pa/update/paupdate.jsp
• /employee/profile/profile.jsp
• contracts.jsp
• workRules.jsp
• timeoff.jsp
• work_area_qual.jsp
• budgetconstraints.jsp
• manualinput.jsp
• modify.jsp
• parameters.jsp
• dailyschedule.jsp
• availShifs.jsp
• dataServiceConfig.jsp
• iTimeClock.jsp
• mngoveride.jsp
• ArchiveTimeData.jsp
• Overide.jsp
• Punches.jsp
• benadjpopup.jsp
• dbUtil.jsp

Reason and prerequisites

WFM (CA-GTF-WFA) executes certain functions by referencing specific URLs. If an attacker tricks an authenticated user's browser into making a request containing a specific URL and parameters, the function executes with the user's privileges. This vulnerability can be exploited via Cross-Site Request Forgery (XSRF) or by using a Cross-Site Scripting (XSS) attack to trigger the exploit.

References

• Unauthorized usage of application functionality (Note 1450166)