SAP Security Note
Medium priority
SAP security note 1672882, “Unauthorized use of User Mapping functions in portal”, is a program error note released on 10.07.2012. Below are the symptom and SAP recommended solution.
Description
Symptom
An attacker can execute functions in the User Mapping Portal component application without authentication and authorization.
Solution
To apply XSRF protection for the User Mapping Portal component application, please update the AS Java to the latest patch level as specified in the Support Package Patch level section below.
Reason and prerequisites
The User Mapping Portal component application executes certain functions by referencing specific URLs. When an attacker tricks an authenticated user’s browser into making a request containing a specific URL and parameters, the function is executed with the rights of the authenticated user. The attacker may use a cross-site scripting (XSS) attack to achieve this or present a malicious link to the victim.
Full note on SAP: SAP Support Launchpad note 1672882
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].