XSRF in BSP Pages (DEV), SAP security note 1588736

SAP security note 1588736, “XSRF in BSP Pages (DEV)”, released on November 8, 2011. Below are the symptom and SAP recommended solution.

Description

Symptom

An attacker can execute functions in BC-MOB-MI without authentication and authorization.

Solution

For the stateless BSP application:

• Refer to Note 1520324 and Note 1551982 for additional information and instructions. These corrections are prerequisites for implementing this note.
• Implement the correction instructions of this note. This will create the report BSP_XSRF_PARAM_BC_MOB.
• Execute the report BSP_XSRF_PARAM_BC_MOB and specify the corresponding transport request number when prompted. This will activate XSRF protection for the BSP applications adapted by this note.

For the stateful BSP application:

• Refer to Note 1520324 for additional information and instructions. The corrections from this note are prerequisites for implementation.
• Implement the correction instructions of this note. This will create the report BSP_XSRF_PARAM_BC_MOB.
• Execute the report BSP_XSRF_PARAM_BC_MOB and specify the corresponding transport request number when prompted. This will activate XSRF protection for the BSP applications adapted by this note.

Reason and prerequisites

BC-MOB-MI executes certain functions by referencing specific URLs. When an attacker tricks an authenticated user's browser into making a request containing a specific URL and parameters, the function is executed with the user's rights. This can be achieved through cross-site scripting attacks or by presenting a malicious link to the victim.