Unauthorized use of application functions in BW-BCT-CRM-RTOM, SAP security note 1624909

SAP security note 1624909, “Unauthorized use of application functions in BW-BCT-CRM-RTOM”. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

A malicious user can execute functions in BW-BCT-CRM-RTOM without authentication and authorization.

Solution

• Prerequisites: refer to SAP Note 1532403 for additional information and instructions. The corrections from this note are a prerequisite for implementing this note. Additionally, from SP08 onwards, implement SAP Note 1551982.
• Implement Correction Instructions: follow the correction instructions of this note to create the report BSP_XSRF_PARAM_BW_BCT_CRM in your system.
• Execute the Report: run the report BSP_XSRF_PARAM_BW_BCT_CRM and specify a corresponding transport request number when prompted. This will activate the XSRF protection for the BSP applications adapted by this note.

Reason and prerequisites

BW-BCT-CRM-RTOM executes certain functions by referencing specific URLs. When a malicious user tricks an authenticated user’s browser into making a request containing a certain URL and specific parameters, the function is executed with the rights of the authenticated user. The malicious user may use a cross-site scripting attack to do this or present a link to the victim.

References

• 1532403: BSP XSRF framework as transport files
• 1551982: Cross-site request forgery protection for stateless

Affected components

• BI_CONT: versions 703, 704, 705, 706, 711, 735, 736, 746