Skip links
RedRays - Your SAP Security Solution
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

SAP Security on Udemy

Cross-Site Request Forgery (CSRF) vulnerability in SAP Web Dynpro ABAP, SAP security note 2747062

SAP Note 2747062
SAP Security Note
Medium priority

SAP security note 2747062, “Cross-Site Request Forgery (CSRF) vulnerability in SAP Web Dynpro ABAP”, is a program error note released on July 28, 2020. Below are the symptom and SAP recommended solution.

ComponentBasis Components > Web Dynpro > Web Dynpro ABAP
CategoryProgram error
PriorityCorrection with medium priority
TypeSAP Security Note
Version6
StatusReleased for Customer
Released onJuly 28, 2020

Description

Symptom

Web Dynpro ABAP allows an attacker to trick an authenticated user into sending unintended requests to the web server. This vulnerability is due to insufficient CSRF protection. Impacts include:

  • Actions taken on behalf of an authenticated user
  • Loss of non-repudiation

Solution

Apply the correction instructions provided in the SAP Note or install the relevant service pack. After starting the trace tool, a confirmation page will prompt the user to confirm the start of tracing.

Reason and prerequisites

You must start the trace tool in Web Dynpro ABAP.

CVSS

Score 5.0 Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

Full note on SAP: SAP Support Launchpad note 2747062

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Open redirect #Cross-site redirect #Cross-domain redirect #XSRF #Session riding

Explore More