SAP security note 1594140, “Unauthorized use of application functions in CRM-MKT-MPL-SP”. Below are the symptom and SAP recommended solution.
Description
Symptom
A malicious user can execute functions in CRM-MKT-MPL-SP without authentication and authorization.
Solution
- Refer to Note 1520324 and Note 1551982 for additional information and instructions. The corrections from these notes are prerequisites for implementing this note.
- Implement the correction instructions of this note. This will also create the report BSP_XSRF_PARAM_CRM_MKT_MPL in your system.
- Execute the report BSP_XSRF_PARAM_CRM_MKT_MPL and specify a corresponding transport request number when prompted. The report will activate the XSRF protection for the BSP applications adapted by this note.
Reason and prerequisites
CRM-MKT-MPL-SP executes certain functions by referencing specific URLs. When a malicious user tricks an authenticated user’s browser into making a request containing a certain URL and specific parameters, the function is executed with the rights of the authenticated user. The malicious user may use a cross-site scripting attack to do this, or they may present a link to the victim.
Full note on SAP: SAP Support Launchpad note 1594140
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
