SAP security note 1606267, "Unauthorized use of application functions in ERMS Web Forms", is a note. Below are the symptom and SAP recommended solution.
Description
Symptom
A malicious user can execute functions in the ERMS Web Form Connector without authentication and authorization.
Solution
After implementing the correction instructions, the form data of your application will not be submitted to ERMS directly. Instead, a confirmation page with the entered data will be rendered for verification by the user. Only after confirming the data will the entered data be submitted to ERMS.
Reason and prerequisites
The ERMS Web Form Connector executes certain functions by referencing specific URLs. When a malicious user tricks an authenticated user’s browser into making a request containing a certain URL and specific parameters, the function is executed with the rights of the authenticated user. The malicious user may use a cross-site scripting attack to do this, or they may present a link to the victim.
Full note on SAP: SAP Support Launchpad note 1606267
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].