Medium priority
SAP security note 2658149, "Cross-Site Request Forgery (CSRF) vulnerability in F2626 and F1680", released on 28.06.2018. Below are the symptom and SAP recommended solution.
Description
Symptom
Fiori applications F2626 and F1680 have been identified with a Cross-Site Request Forgery (CSRF) vulnerability. This allows an attacker to trick an authenticated user into sending unintended requests to the web server due to insufficient CSRF protection.
- Unauthorized Actions: An attacker could perform actions on behalf of an authenticated user
- Loss of Non-Repudiation: Users may be unable to deny actions performed on their behalf
Solution
To mitigate this vulnerability:
- Change HTTP Methods: Modify the HTTP request methods of function imports from GET to POST
- Adjust Web Applications: Update the web applications accordingly to accommodate these changes
- Apply Correction Instructions: Use transaction SNOTE to apply the provided correction instructions
Reason and prerequisites
The vulnerability arises from the application’s inadequate protection against CSRF attacks. No additional prerequisites are required beyond the application being accessible and the user being authenticated.
Full note on SAP: SAP Support Launchpad note 2658149
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].