XSRF possible in SPML Services in AS Java, SAP security note 1616058

SAP security note 1616058, "XSRF possible in SPML Services in AS Java", is a workaround of missing functionality note released on 16.05.2012. Below are the symptom and SAP recommended solution.

Description

Symptom

A malicious user can execute web application functions through SPML services in SAP NetWeaver AS Java on behalf of a legitimate user, without their consent.

SPML services execute certain functions by referencing specific URLs. A malicious user can trick an authenticated user into making requests with specific URLs and parameters, potentially executing functions with the user’s privileges. This can be done via cross-site scripting attacks or by presenting a crafted link to the victim.

Solution

Update AS Java to a support package or release where the issue is fixed. Apply patches available for SAP products using the SPML interface. For more details, see the related note.

Workaround: If using third-party SPML clients that cannot be updated, you may disable the protection by setting the UME property ume.spml.http_header_check_active to false. This requires a cluster restart and additional protection mechanisms like URL filtering via ICM, load balancers, or firewalls.

CVSS

Score 6.8 Vector: AV:N/AC:M/AU:N/C:P/I:P/A:P

References

• Security Note 1631354 – Update 1 to Security Note 1616058
• Security Note 1621289 – SPML Connection Between SAP NW IdM and NW AS Java Fails
• Security Note 1616259 – Briefing at Black Hat conference on August 4th, 2011
• Security Note 1451753 – Filtering of administration requests for AS Java