Cross-Site Request Forgery (CSRF) vulnerability in Dynpro Processing in SAP GUI for HTML, SAP security note 2316723

SAP security note 2316723, “Cross-Site Request Forgery (CSRF) vulnerability in Dynpro Processing in SAP GUI for HTML”, is a program error note released on 19.05.2017. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

The Dynpro processing within SAP GUI for HTML allows an attacker to trick an authenticated user into sending unintended requests to the Web server. This vulnerability is due to insufficient CSRF protection.

Impacts of CSRF Vulnerability:

• Attacker can perform actions on behalf of an authenticated user.
• Loss of non-repudiation.

Solution

Please install the kernel patch related to this SAP Note or a newer version.

Reason and prerequisites

If a user with malicious intent uses classic transactions rendered in SAP GUI for HTML, they may provoke a request forgery. By entering a specially crafted text value into the OK code field, cross-site request forgery can be achieved.

References

Affected components

• SAP KERNEL 7.22, 7.42, 7.45, 7.49 (64-BIT UNICODE and 64-BIT)