SAP security note 1588184, “Unauthorized use of application functions in PA-PD-PM/PA-XF”, is a note. Below are the symptom and SAP recommended solution.
Description
Symptom
An attacker can execute functions in PA-PD-PM and PA-XF without proper authentication and authorization.
Solution
- Ensure that you have implemented the corrections from Note 1520324. These corrections are required before applying this security note.
- Follow the correction instructions provided in this note. Depending on your SAP release, use the attachments to create the relevant reports as local objects in your system. The attachments include scripts for various software components such as:
- SAP_ABA 730: ZBSP_XSRF_PARAM_HAP_PROF_640
- SAP_ABA 711: ZBSP_XSRF_PARAM_HAP_PROF_640
- SAP_ABA 700-702: ZBSP_XSRF_PARAM_HAP_PROF_640
- EA-HRGXX 200 & 110: ZBSP_XSRF_PARAM_HAP_PROF_200 and ZBSP_XSRF_PARAM_HAP_PROF_110
- Run the created local report and specify the relevant transport request number when prompted. This will populate the BSPTEMPXSRFSTORE database table with necessary entries for the adapted BSP applications.
Reason and prerequisites
The vulnerability arises because PA-PD-PM and PA-XF execute certain functions by referencing specific URLs. An attacker can trick an authenticated user’s browser into making a request with malicious URLs and parameters, causing the function to execute with the user’s privileges. This can be achieved through cross-site scripting (XSS) attacks or by enticing the victim to click on a malicious link.
Implementing this security note is crucial to prevent potential CSRF attacks that could allow unauthorized actions within your SAP system, potentially compromising sensitive data and system integrity.
Full note on SAP: SAP Support Launchpad note 1588184
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
