SAP security note 1448007, "Cross-Site Request Forgery Attack", is released on August 12, 2010. Below are the symptom and SAP recommended solution.
Description
Symptom
A malicious user can trigger functionality in BPC MS without authentication and authorization.
Solution
The issue is corrected in 75M SP2 Patch1. After installing the service pack, define the "AllowedSite" parameter in Web.config by adding the following configuration to the Web.config file on each web server: <configuration><appSettings><add key="AllowedSite" value="www.yahoo.com,www.google.com" /></appSettings></configuration>
- Define this parameter on each WebServer.
- List all allowed fully qualified domain names separated by commas.
- Do not use wildcard characters (e.g., *.yahoo.com).
- Host names must include the full host header name (e.g., www.yahoo.com,www1.yahoo.com,hosting.yahoo.com).
Reason and prerequisites
BPC MS executes certain functions through specific URLs. An attacker can trick an authenticated user’s browser into making requests with specific parameters, causing functions to execute with the user’s privileges. This can be exploited via CSRF or potentially combined with Cross-Site Scripting (XSS) attacks.
References
- 1456848 – Planning and Consolidation 75M SP2 Patch2
- 1448569 – Planning and Consolidation 75M SP2 Patch1
Full note on SAP: SAP Support Launchpad note 1448007
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].