Unauthorized use of application functions in CRM-BF-WFI, SAP security note 1593363

SAP security note 1593363, "Unauthorized Use of Application Functions in CRM-BF-WFI", addresses a security vulnerability affecting SAP systems. Below are the symptom and SAP recommended solution.

Description

Symptom

A malicious user can execute functions in CRM-BF-WFI without authentication and authorization.

Solution

1. Refer to Note 1520324 and Note 1551982 for additional information and instructions. The corrections from these notes are prerequisites for implementing this security note.
2. Implement the correction instructions of this note. This will create the report BSP_XSRF_PARAM_CRM_BF_WFI in your system.
3. Execute the report BSP_XSRF_PARAM_CRM_BF_WFI and specify a corresponding transport request number when prompted. This report will activate XSRF protection for the BSP applications adapted by this note.

Reason and prerequisites

CRM-BF-WFI executes certain functions by referencing specific URLs. When a malicious user tricks an authenticated user’s browser into making a request containing a certain URL and specific parameters, the function is executed with the rights of the authenticated user. The attacker may use a cross-site scripting (XSS) attack to achieve this or present a malicious link to the victim.