SAP security note 1611180, "Unauthorized use of application functions in AIE-AII-UI", is a note. Below are the symptom and SAP recommended solution.
Description
Symptom
An attacker can execute functions in the ITSmobile UI of component AIE-AII-UI without authentication and authorization.
Solution
- Refer to the notes 1481392 and 1571684 for additional information and instructions. The corrections from note 1481392 are a prerequisite for the implementation of this note.
- Implement the correction instructions of this note. This will also create the report ITS_XSRF_PARAM_AIE in your system.
- Execute the report ITS_XSRF_PARAM_AIE and specify when requested a corresponding transport request number. The report will add service parameters for the adapted ITS services (maintained via the GUI configuration pushbutton for a service within transaction SICF).
Please note, if you use your individual templates you have to regenerate them after step 3. You can use report SIAC_REGENERATE_TEMPLATES for this.
When you regenerate individual templates linked to the service AIN_MOBILE, make sure just the lines with individual templates are selected when you execute the report. No standard template should be regenerated.
Reason and prerequisites
The AutoID ITSmobile UI executes certain functions by referencing specific URLs. When an attacker tricks an authenticated user’s browser into making a request containing a certain URL and specific parameters, the function is executed with the rights of the authenticated user.
The attacker may use a cross-site scripting attack to do this, or they may present a link to the victim.
Full note on SAP: SAP Support Launchpad note 1611180
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
