Unauthorized use of application functions in PI Demo Example, SAP security note 1607014

SAP security note 1607014, “Unauthorized use of application functions in PI Demo Example”, is a note. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

A malicious user can execute functions in the PI Demo Example without authentication and authorization.

Solution

The PI Demo Application is not active by default and cannot be accessed unless configured, which is not allowed in productive systems. To mitigate this vulnerability:

• Deactivate the Demo Application: In transaction SICF, deactivate the demo application to prevent access via URL.
• Implement Correction Instructions: Import the relevant support package or follow the correction instructions provided in this note. Delete the user and password settings for this application in transaction SICF. Ensure that client information (105) is set. Execute the program BSP_XSRF_PARAM_SXIDEMO and select the transport request when prompted. This program will make the necessary entries for the BSP application in the database table BSPTEMPXSRFSTORE.

Refer to Note 1520324 and Note 1551982 for additional information and instructions. The corrections from these notes are prerequisites for implementing this note. Implement the correction instructions contained in this note, which will create the program BSP_XSRF_PARAM_SXIDEMO in your system.

Reason and prerequisites

The PI Demo Example executes certain functions by referencing specific URLs. When a malicious user tricks an authenticated user’s browser into making a request containing a specific URL and parameters, the function is executed with the rights of the authenticated user. This can be achieved through cross-site scripting attacks or by presenting a link to the victim.

Affected components

• Basis Components > NetWeaver Process Integration (PI)