SAP security note 1327872, "Unauthorized usage of functionality in Web Dynpro for Java", is released on 19.08.2010. Below are the symptom and SAP recommended solution.
Description
Symptom
A malicious user can trigger functionality in Web Dynpro for Java without authentication and authorization.
Solution
To improve resistance against XSRF attacks, the WebDynpro framework now generates a unique token per application session. The solution is available from the following support packages for the corresponding NW release:
- NW 7.00: SP22 Patch Level 00 and above.
- NW 7.01: SP07 Patch Level 00 and above.
- NW 7.02: SP03 Patch Level 00 and above.
- NW 7.10: SP07 Patch Level 11 and above.
- NW 7.11: SP03 Patch Level 00 and above.
- NW 7.20: Available on all support packs.
Reason and prerequisites
Web Dynpro for Java executes certain functions through referencing specific URLs. If an attacker tricks an authenticated user’s browser into making a request containing a certain URL and specific parameters, the function is executed with the user’s rights.
Attackers may use a Cross Site Scripting attack to trigger the exploit or present a link for the victim to click.
Full note on SAP: SAP Support Launchpad note 1327872
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].