SAP security note 1637611, "CSRF vulnerability in Web Page Composer". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An attacker can execute functions in Web Page Composer without authentication and authorization.
Solution
For more information about the affected releases, see the "SP Patch Level" tab page of this SAP note.
Reason and prerequisites
Web Page Composer executes certain functions by referencing specific URLs. When an attacker tricks an authenticated user’s browser into making a request containing a specific URL and parameters, the function is executed with the rights of the authenticated user. This can be achieved through a cross-site scripting (XSS) attack or by presenting a malicious link to the victim.
References
- SAP Note 1676329 – KMC in EHP1 for SAP NetWeaver 7.0 SPS11 – Add-on
- SAP Note 1620044 – KM UI vulnerable to CSRF attacks
- SAP Note 1450166 – Unauthorized usage of application functionality
Affected components
- KMC-WPC: Versions 7.00 to 7.02, 7.30, 7.31
Full note on SAP: SAP Support Launchpad note 1637611
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].