SAP security note 1511462, "Unauthorized usage of application functionality-Java ToolBox". Below are the symptom, the SAP recommended solution and the affected software components.
Description
Symptom
This security note has been updated. For more detailed information, see SAP Note 1604636.
A malicious user can trigger functionality in SRM Java Tool Box without authentication and authorization.
Solution
You can find SRM Java Tool Box 7.0 in the Support Package and Patch Area of the Service Marketplace.
Reason and prerequisites
Java Tool Box executes certain functions through referencing specific URLs. When an attacker tricks an authenticated user’s browser into making a request containing a certain URL and specific parameters, the function is executed with the rights of the user.
If present, the attacker may use a Cross Site Scripting attack to trigger the exploit, or use an approach in which a link to click is presented to the victim.
References
- Security Note 1604636 – Update #1 to Security Note 1511462
- Security Note 1511729 – Deletion of SRM Portal Toolkit Role and Related IViews
Affected components
- SRMJVTB: 7.0
Full note on SAP: SAP Support Launchpad note 1511462
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
