SAP security note 1510091, "Unauthorized usage of application functionality in MFG-MII", is a note. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An unauthorized user can trigger functionality in SAP Manufacturing Integration and Intelligence (MII) on behalf of an unsuspecting authorized user, leading to potential Cross-Site Request Forgery (CSRF) attacks.
This vulnerability allows unauthenticated third parties to execute state-changing operations in MII without the authorized user’s knowledge or consent.
Solution
To address this vulnerability, implement XSRF protection by adopting the SAP NetWeaver Application Server Java’s XSRF Protection Framework. Follow the steps below:
- Apply Required Notes: Ensure that SAP Note 1450166 is applied to enable the XSRF Protection Framework.
- Configure XSRF Protection: Copy the xsrf-config.xml file attached to this note into the /WEB-INF directory of your MII application. Replace the existing JSP files with the ones provided in the XSRF_JSP_FILES.zip attachment. These enhanced JSP pages include tokens for state-critical actions.
- Handle Customizations: If you have modified JSP pages for custom branding or other purposes, manually incorporate the token additions to maintain XSRF protection. For any additional or custom state-changing actions, configure them in the xsrf-config.xml file and include the necessary tokens in your pages.
- Review and Test: After implementing the changes, thoroughly test your application to ensure that XSRF protections are functioning correctly without disrupting legitimate operations.
References
Affected components
- XMII 12.0
- XMII 12.1
Full note on SAP: SAP Support Launchpad note 1510091
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].