SAP Security Note
SAP security note 2784596, "Cross-Site Request Forgery (CSRF) vulnerability in Run Compliance Report", released on 08.03.2022. Below are the symptom and SAP recommended solution.
Description
Symptom
UPDATE 8th March 2022: This note has been re-released with updated ‘Correction instruction’ information. We have limited the validity of the prerequisite note 2637403 to SP0.
Run Advanced Compliance Report allows an attacker to trick an authenticated user into sending unintended requests to the web server. This vulnerability is due to insufficient CSRF protection.
Impacts of CSRF vulnerability:
- Attacker could take actions on behalf of an authenticated user
- Loss of non-repudiation
Solution
- Changed HTTP method types from ‘GET’ to ‘POST’ for the identified function imports.
- Proper utilization of the XSRF protection framework, ensuring correct authentication tokens are present.
SAP recommends installing solutions by applying a Support Package. If an earlier installation is necessary, use the Note Assistant to implement the correction instruction. More information about the Note Assistant can be found on the SAP Service Marketplace.
Reason and prerequisites
Few function imports as part of OData services were discovered to be vulnerable to CSRF.
CVSS
Score 4.2 Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L
Full note on SAP: SAP Support Launchpad note 2784596
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].