Unauthorized changes and execution for RSBCT_RFASH_ALI, SAP security note 1566039

SAP security note 1566039, "Unauthorized changes and execution for RSBCT_RFASH_ALI". Below are the symptom and SAP recommended solution.

Description

Symptom

Malicious execution of BSP functions via unauthorized access. Modification of BSP content leading to stored cross-site scripting (XSS) vulnerabilities.

Solution

• Implement correction instructions: Follow the correction instructions provided in this note to address the vulnerabilities.
• Execute the report BSP_XSRF_PARAM_RSBCT_RFASH_ALI: Specify a relevant transport request number when prompted. This will populate the database table BSPTEMPXSRFSTORE with necessary entries for the adapted BSP applications.

Reason and prerequisites

Symptom 1: Unauthorized execution occurs when a malicious user tricks an authenticated user's browser into making specific requests, possibly using cross-site scripting (XSS) attacks. Symptom 2: Manipulation of BSP components allows permanent modification of web content and theft of user authentication data. Prerequisite: Implementation of Note 1520324 is required before applying this security note.

References

• Note 1677194 – Unauthorized modification of stored content in RSBCT_RFASH_ALI
• Note 1540729 – ASU content for activating XSRF protection for BSP
• Note 1520324 – Advance creation of XSRF information