Unauthorized use of application functions in Flex app., SAP security note 1599361

SAP security note 1599361, “Unauthorized use of application functions in Flex app”, is a security note. Below are the symptom and SAP recommended solution.

Description

Symptom

A malicious user can execute functions in WebClient UI Flex applications without authentication and authorization.

Solution

Implement the attached correction instructions.

Reason and prerequisites

Flex applications execute certain functions by referencing specific URLs. When a malicious user tricks an authenticated user’s browser into making a request containing a certain URL and specific parameters, the function is executed with the rights of the authenticated user. The malicious user may use a cross-site scripting attack to do this, or they may present a link to the victim.