SAP Security Note
High priority
SAP security note 1506855, "Unauthorized usage of functionality in workflow area", released on 25.11.2011. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An attacker can trigger functionality in the Business Workflow area without the relevant authentication and authorization.
Solution
To address this vulnerability, follow these steps:
1. Prerequisite: Read Note 1520324 for additional information and further instructions. The corrections from Note 1520324 are required before implementing this note.
2. Implement correction instructions: Apply the correction instructions contained in this note. This will create the program BSP_XSRF_PARAM_BC_BMT_WFM in your system, among other changes.
3. Execute the program: Run the program BSP_XSRF_PARAM_BC_BMT_WFM and select the transport request when prompted. This program will make the necessary entries for the BSP applications adjusted by this note in the database table BSPTEMPXSRFSTORE.
Reason and prerequisites
Specified BSP applications execute certain functions by referencing specific URLs. When an attacker tricks an authenticated user’s browser into making a request containing a certain URL and specific parameters, the functions are executed in the Business Workflow area with the user’s rights. Additionally, an attacker may use a Cross Site Scripting (XSS) attack to trigger the exploit or present a clickable link to the victim.
References
Affected components
- SAP_BASIS: versions 620 to 640, 700 to 702, 710 to 730
Full note on SAP: SAP Support Launchpad note 1506855
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].