Cross-Site Request Forgery (CSRF) vulnerability in SAP BOBJ BI Platform, SAP security note 2335427

SAP security note 2335427, “Cross-Site Request Forgery (CSRF) vulnerability in SAP BOBJ BI Platform.” Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

The presence of the crossdomain.xml file allows Flash files (.swf) running in Adobe Flash Player from other domains to access resources on your application server. An overly permissive crossdomain.xml file enables an attacker to trick an authenticated user into sending unintended requests to the web server. This vulnerability is due to insufficient CSRF protection.

Impact of CSRF vulnerability:

• Attackers can perform actions on behalf of authenticated users.
• Loss of non-repudiation.

Solution

• Apply Support Packages and Patches: Implement the Support Packages and Patches referenced by this SAP Note. This will install the crossdomain.sap.template.xml file to Tomcat’s ROOT web application folder (default path: C:\Program Files (x86)\SAP BusinessObjects\tomcat\webapps\ROOT on Windows).
• Review and Secure crossdomain.xml: Check if crossdomain.xml exists in your application server’s ROOT web application folder. If it exists, open it using a text editor and adjust the permissions if it is overly permissive. Refer to the crossdomain.sap.template.xml file or the Adobe Flash Player Security White Paper for guidance.
• Remove Unnecessary crossdomain.xml: If you do not require Flash files from other domains to access resources on your application server, you can remove the crossdomain.xml file entirely.

Reason and prerequisites

The crossdomain.xml file shipped with SAP BOBJ BI Platform is overly permissive, allowing attackers to obtain access to sensitive information that should be restricted.

CVSS

Score 6.1/10 Vector: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected components

• ENTERPRISE: Versions 410 to 420
• SBOP BI PLATFORM SERVERS 4.1 and 4.2