SAP security note 2719415, "Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4 HANA for Advanced Compliance Reporting/ Run Advanced Compliance Report", is a note. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
SAP S/4 HANA for Advanced Compliance Reporting/ Run Advanced Compliance Report allows an attacker to trick an authenticated user into sending unintended requests to the web server. This vulnerability is due to insufficient CSRF protection.
Some well-known impacts of CSRF vulnerability are:
- Attacker could take actions on behalf of an authenticated user
- Loss of non-repudiation
Solution
- HTTP Method Update: Changed from GET to POST for the identified function imports.
- XSRF Protection: The XSRF protection framework is now properly utilized, ensuring that correct authentication tokens are present.
This Note is valid for the S/4HANA 1809 SP0 release.
Recommendation: SAP recommends installing the solution by applying a Support Package. If an earlier installation is needed, use the Note Assistant to implement the correction instructions. More information about the Note Assistant can be found on SAP Service Marketplace.
Reason and prerequisites
Several function imports as part of OData services were discovered to be vulnerable to CSRF.
CVSS
Score 6.3 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Affected components
- FI-LOC-SRF-RUN
Full note on SAP: SAP Support Launchpad note 2719415
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
