SAP security note 1752717, "Unauthorized usage of application functionality in MFG-LPO". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An attacker can execute functions in MFG-LPO without proper authentication and authorization, exploiting Cross-Site Request Forgery (CSRF/XSRF) vulnerabilities.
Unauthorized and unauthenticated third parties can trigger state-changing functionalities on behalf of authorized users without their knowledge or consent.
Solution
Implement the XSRF Protection Framework provided by SAP NetWeaver Application Server Java (AS Java).
- Apply SAP Note 1450166 to ensure the availability of the XSRF Protection Framework.
- Copy the xsrf-config.xml file attached to this note into the /WEB-INF directory of your application.
- Replace the existing JSP files with the ones provided in the attached XSRF_JSP_FILES.zip, ensuring state-critical actions have tokens attached either as URL parameters or hidden form fields.
- If your JSP pages have been customized, manually integrate the token mechanism to avoid losing changes during the replacement; for additional custom pages with state-changing actions, configure the actions in xsrf-config.xml and include tokens in URL parameters or hidden form fields.
Implementing this security measure is crucial to protect against CSRF/XSRF attacks and ensure the integrity of your SAP Lean Planning and Operation (MFG-LPO) system.
References
Affected components
- SAP Lean Planning and Operation (MFG-LPO): Version 5.60
Full note on SAP: SAP Support Launchpad note 1752717
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
