Unauthorized use of application functions in CRM-MKT-ML, SAP security note 1593699

SAP security note 1593699, “Unauthorized use of application functions in CRM-MKT-ML”. Below are the symptom and SAP recommended solution.

Description

Symptom

A malicious user can execute functions in CRM-MKT-ML without authentication and authorization.

Solution

• Refer to Note 1520324 and Note 1551982 for additional information and instructions. The corrections from these notes are prerequisites for implementing this note.
• Implement the correction instructions of this note. This will create the report BSP_XSRF_PARAM_CRM_MKT_ML in your system.
• Execute the report BSP_XSRF_PARAM_CRM_MKT_ML and provide a corresponding transport request number when prompted. This report will activate the XSRF protection for the BSP applications adapted by this note.

Reason and prerequisites

CRM-MKT-ML executes certain functions by referencing specific URLs. When a malicious user tricks an authenticated user's browser into making a request containing a certain URL and specific parameters, the function is executed with the rights of the authenticated user. This can be achieved through a cross-site scripting attack or by presenting a deceptive link to the victim.