Unauthorized use of application functions in BC-SRV-SSF, SAP security note 1591024

SAP security note 1591024, "Unauthorized use of application functions in BC-SRV-SSF". Below are the symptom and SAP recommended solution.

Description

Symptom

A malicious user can execute functions in BC-SRV-SSF without authentication and authorization.

Solution

Implement the corrections using the Note Assistant or import the relevant Support Package. If you use the Note Assistant to implement this note, note the following:

• For additional information and instructions, see Note 1520324. The corrections from Note 1520324 are a prerequisite for implementing this note.
• Implement the attached correction instructions. Create the report BSP_XSRF_PARAM_SSF as a local object in your system.
• Execute the report BSP_XSRF_PARAM_SSF and when requested, specify a relevant transport request number. The report will fill the database table BSPTEMPXSRFSTORE with relevant table entries for the BSP applications adapted by this note.

Reason and prerequisites

BC-SRV-SSF executes certain functions by referencing specific URLs. When a malicious user tricks an authenticated user’s browser into making a request containing a certain URL and specific parameters, the function is executed with the rights of the authenticated user. The malicious user may use a cross-site scripting attack to do this, or they may present a link to the victim.