MDSD Admin Console is vulnerable to XSRF attacks., SAP security note 1582983

SAP security note 1582983, "MDSD Admin Console is vulnerable to XSRF attacks". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

An unauthorized user can trigger functionality in the MDSD Admin Console on behalf of an unsuspecting authorized user by deceiving them into triggering a URL callback via a script or special HTML element parameter.

Solution

XSRF attacks must be addressed within web applications. These applications must ensure that for state-changing operations, they are not relying solely on credentials or tokens that are automatically submitted by browsers. A common approach is to include a special token in each request, which is associated with the user session and is valid only for the session’s lifetime.

The SAP NetWeaver Application Server Java (AS Java) has been enhanced with the XSRF Protection Framework. You can secure your web application with the token-based approach by adopting this framework. This note contains the steps to adopt the XSRF Protection Framework for the MDSD Admin Console.

SAP’s XSRF Protection Framework is available for specific versions of SAP NetWeaver. Please refer to Note 1450166 for details regarding availability. To enable XSRF protection for the MDSD Admin Console, apply the aforementioned note before undertaking the steps highlighted in this note. Additionally, refer to the SAP XSRF Protection Guide to gain an overall understanding of the XSRF protection procedure.

Once you have reviewed the above documentation, follow these detailed steps specific to the MDSD Admin Console:

• Standard XSRF Protection Approach: XSRF protection for the MDSD Admin Console uses the standard XSRF protection approach. Refer to the Protection Guide for details.
• Obtain Latest Hotfix: According to Note 1582779, obtain the latest Hotfix and deploy the newest version of MDSD.ear to your J2EE.
• Modified JSP Pages: If the JSP pages have been modified (e.g., for customer-specific branding), manually include the changes that add tokens to state-changing actions to prevent loss of modifications.
• Additional State-Changing Actions: Configure additional actions triggering state changes on AS Java in the xsrf-config.xml file, and include URL parameters or hidden form fields on the pages to add the tokens. Refer to the Protection Guide for details.

Affected SAP delivered JSP pages in the MDSD Admin Console: /tmpls/lLogin.jsp, /tmpls/detail1.jsp, /tmpls/search1.jsp, /tmpls/list1.jsp, /tmpls/list2.jsp, /tmpls/settings.jsp.

Reason and prerequisites

The MDSD Admin Console (which contains Servlets/JSP pages) executes state-changing functionality via URLs. In certain scenarios, it is possible for an unauthorized and unauthenticated third party to trigger this functionality on behalf of an authorized authenticated user without the latter’s knowledge and/or consent.

References

• SAP Note 1680716 – Unauthorized modification of displayed content in MDSD Admin
• SAP Note 1582779 – Patch for MDSD Admin Console
• SAP Note 1450166 – Unauthorized usage of application functionality

Affected components

• MBA-DSD 2.1, 3.0, 4.0
• MDSDADMINCONSOLE 4.0