SAP security note 1511280, "Unauthorized usage of application functionality in IS-U-WA", is a note. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
A malicious user can trigger functionality in IS-U-WA without proper authentication and authorization.
Solution
- Refer to Note 1481392 for additional information and instructions. Implementing the corrections from this note is a prerequisite for applying this security note.
- Implement the correction instructions of this note. This will create the report ITS_XSRF_PARAM_ISUWA in your system.
- Execute the report ITS_XSRF_PARAM_ISUWA and provide a corresponding transport request number when prompted. The report will add service parameters for the adapted ITS services, which can be maintained via the GUI configuration pushbutton within the SICF transaction.
Reason and prerequisites
The IS-U-WA module executes certain functions by referencing specific URLs. An attacker can exploit this by tricking an authenticated user’s browser into making a request with a crafted URL and specific parameters. This results in the unauthorized execution of functions with the user’s privileges.
Potential attack vectors include:
- Cross Site Scripting (XSS) attacks to trigger the exploit.
- Presenting a malicious link for the victim to click.
The ITS-Service EWHV_WASTE within the EEWA package, designed to display detailed information for waste objects, is vulnerable. It can be manipulated to replace generated HTML content or inject scripts to submit unauthorized OK_CODE commands or steal the current session.
To mitigate this, the connected SICF-Node EWHV_WASTE has been modified to:
- Prohibit any OK_CODE handling.
- Prevent session stealing within the ITS-Service.
CVSS
Score 0
References
Affected components
- IS-UT 600
- IS-UT 602
- IS-UT 603
- IS-UT 604
- IS-UT 605
Full note on SAP: SAP Support Launchpad note 1511280
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].