SAP security note 1567128, "Unauthorized use of application functions in System Login". Below are the symptom and SAP recommended solution.
Description
Symptom
A malicious user can execute functions in ICF System Login without proper authentication and authorization. This vulnerability allows unauthorized actions by tricking an authenticated user’s browser into making specific requests.
Solution
Apply the ABAP correction. It is strongly recommended to implement the relevant Support Package instead of using Correction Instructions due to the necessary manual changes involved.
- Create data elements: define new data elements such as ICFAUTOLOGIN, ICFCERTREQUEST, ICFCERTUSRLNK, etc., in the package SICF_EXT_LOGIN.
- Add documentation: document the newly created data elements appropriately to ensure clarity and maintainability.
- Modify data structure: update the ICFSYSLOGPARAMS structure by appending the required components in the specified order. The structure must match the provided specifications exactly to avoid compile errors.
- Create messages for ICF_SYSTEM_LOGIN: define messages 402, 403, 404, and 405 to handle various login scenarios and failures.
SAP recommends implementing the Support Package to avoid manual changes; if opting for Correction Instructions, carefully follow the manual steps to ensure system stability and security.
Reason and prerequisites
ICF System Login executes certain functions by referencing specific URLs. When a malicious user tricks an authenticated user’s browser into making a request containing a specific URL and parameters, the function is executed with the user’s rights. This can be achieved through cross-site scripting attacks or by presenting deceptive links to victims.
References
- SAP Note 1732539 – SAP NetWeaver Gateway deployment w/ GW_CORE 190 IW_FND 240
- SAP Note 1617090 – ICF system logon: Logon fails, logon cookie
- SAP Note 1598015 – Business Workflow Task Execution screen do not open from UWL
- SAP Note 1560585 – SAP Gateway 2.0 Release Note
Full note on SAP: SAP Support Launchpad note 1567128
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].