Unauthorized use of application functions in CRM-ISA, SAP security note 1619202

SAP security note 1619202, "Unauthorized use of application functions in CRM-ISA", is a program error note released on 10.01.2012. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

A malicious user can execute functions in CRM-ISA without authentication and authorization.

Solution

This note provides Java correction(s) for E-Commerce and Web Channel.

• For details on applying Java patches, refer to Note 877887.
• For information about the patch strategy, see Note 1546959.

Reason and prerequisites

CRM-ISA executes certain functions by referencing specific URLs. When a malicious user tricks an authenticated user’s browser into making a request containing a certain URL and specific parameters, the function is executed with the rights of the authenticated user.

The malicious user may use a cross-site scripting attack to achieve this or present a link to the victim.

References

• 1546959 – Patch strategies for SAP E-Commerce solutions
• 1492234 – No SessionIDRegeneration in CRM Web Channel B2C/B2B Scenario
• 877887 – Installing Patches for CRM Java Components and FSCM BD

Affected components

• SAP-CRMJAV (5.0, 6.0, 700, 701, 730)
• SAP-CRMWEB (5.0, 6.0, 700, 701, 730)
• SAP-SHRWEB (5.0, 6.0, 700, 701, 730)
• SAP-SHRJAV (5.0, 6.0, 700, 701, 730)
• SAP-CRMAPP (5.0, 6.0, 700, 701, 730)
• SAP-SHRAPP (5.0, 6.0, 700, 701, 730)