SAP Security Note
High priority
SAP security note 1510620, “Cross-site request forgery fix for MSS financials”, is a program error note released on 14.12.2010. Below are the symptom, reason and prerequisites, and the SAP recommended solution.
Description
Symptom
A malicious user can create table data in applications that are based on Web Dynpro Java without authentication and authorization.
Solution
Implement the program corrections.
Reason and prerequisites
Java Web Dynpro applications in Manager Self-Service financials execute functions that create table data in the back end. When a malicious user tricks an authenticated user’s browser into making a request containing a certain URL and specific parameters, the function is executed with the rights of the authenticated user. The malicious user may use a cross-site scripting attack to do this, or they may present a link to the victim.
Full note on SAP: SAP Support Launchpad note 1510620
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
