SAP security note 1595373, “Unauthorized use of application functions in CRM-IC-SEA”, is a note. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
A malicious user can execute functions in CRM-IC-SEA without authentication and authorization.
Solution
- Implement the corrections from Note 1520324 and Note 1551982. These corrections are prerequisites for the implementation of this note.
- Follow the correction instructions provided in this note. This will create the report BSP_XSRF_PARAM_CRM_IC_SEA in your system. Access the correction instructions here.
- Run the report BSP_XSRF_PARAM_CRM_IC_SEA and specify a corresponding transport request number when prompted. This will activate XSRF protection for the BSP applications adapted by this note.
Reason and prerequisites
CRM-IC-SEA executes certain functions by referencing specific URLs. When a malicious user tricks an authenticated user’s browser into making a request containing a certain URL and specific parameters, the function is executed with the rights of the authenticated user. The malicious user may use a cross-site scripting attack to achieve this, or they may present a link to the victim.
Affected components
- BBPCRM 520
- BBPCRM 600
- BBPCRM 700
- BBPCRM 701
Full note on SAP: SAP Support Launchpad note 1595373
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].