SAP security note 1512891, “CIC: Unauthorized usage of application functionality”, is a note released on 14.12.2010. Below is the security information published by SAP for this note.
Description
A malicious user can trigger functionality in IS-U without authentication and authorization.
Other Terms: Cross-Site Request Forgery, XSRF, FI-CA, IS-U-CS, HTML customer information, action box calls.
Reason and Prerequisites: IS-U-CS executes certain functions through referencing specific URLs. When an attacker tricks an authenticated user's browser into making a request containing a certain URL and specific parameters, the function is executed with the rights of the user.
If present, the attacker may use a Cross Site Scripting attack to trigger the exploit, or use an approach in which a link to click is presented to the victim. This solution applies only to release 6.00 to 6.05 for which the ITS is included in the ICF. Stand alone ITS are out of scope.
Solution
The ITS-Service EWHV and EWB_WEBGUI inside the package EE_CRM_CIC were designed to display detailed information for a chosen IS-U business partner. It can be displayed inside an HTML control, e.g., inside a tab-strip of a CIC solution.
In some cases, it could be possible to replace this generated HTML content or inject scripting to submit an unauthorized OK_CODE to the application handler.
Manual Correction Instructions:
A) Change Settings for Services
1. Refer to note 1481392 for additional information and instructions. The corrections from note 1481392 are a prerequisite for the implementation of this note. 2. Implement the correction instructions of this note. This will also create the report ITS_XSRF_PARAM_EWHV in your system. 3. Execute the report ITS_XSRF_PARAM_EWHV and specify, when requested, a corresponding transport request number. The report will add service parameters for the adapted ITS services (maintained via the GUI configuration pushbutton for a service within transaction SICF).
B) Change Service Templates (Use Note Assistant if Possible)
4. Start SE80 5. Select ITS service ISU_GLOBAL 6. Select HTML-template EWHV_FUNCTIONS and apply the following changes: “abap function callTransaction(trans, param) its = wgateURL(); if (~icf==1) pos = strstr(its, "/sap"); wgate = strsub(its, 0, pos); url = wgate & "sap/bc/gui/sap/its/webgui/!?~transaction=" & trans & "&" & param & "&~okcode=+"; else pos = strstr(its, "/wgate"); wgate = strsub(its, 0, pos+6); url = wgate & "webgui/!?~transaction=" & trans & "&" & param & "&~okcode=+"; end; url = url & "&~sec_sesstoken=" & ~sec_sesstoken; return(url); end; ` 7. Select ITS service EWHV 8. Select HTML-template SAPLEWHV 100 and apply the following changes: `html <script> <!– display transactions do not use this function any more!!!–> function loadURL(trans, param){ wgate = "strsub(wgateURL(), 0, strstr(wgateURL(), "/wgate")+6)"; url = wgate + "webgui/!?~transaction=" + trans + "&" + param + "&~okcode=+"; url = url + "&~sec_sesstoken=" + "~sec_sesstoken"; window.location.href = url; } </script> “
Information for Differences in Releases: This note is for a cross-release correction. Therefore, it is possible that the transaction SICF has a different "look and feel". *Example:* In some releases, the Apply button (4.) could have a different name like "Filter". Another example: In release 3, the input field was named servicename. In other releases, this field can be displayed as "service".
References
- 1520324 – BC-BSP: Advance creation of XSRF information
- 1511280 – IS-U-WA: Unauthorized usage of application functionality in IS-U-WA
Full note on SAP: SAP Support Launchpad note 1512891
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].