SAP security note 2686535, "[CVE-2019-0267] Cross site request forgery in implementation of Manufacturing Integration and Intelligence", is a note. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
MII Illuminator Servlet currently does not provide Anti-XSRF tokens. This might lead to XSRF attacks in case the data is being posted to the Servlet from an external application.
Solution
A new flag named "Enable Illuminator Security" has been introduced as part of MII system properties.
If the flag is added, an additional HTTP POST call with a request parameter "Fetch" can be made to Illuminator Servlet in order to fetch the anti-XSRF token. The returned token needs to be sent with every subsequent call in order to prevent the XSRF attack.
The details of the availability of the new flag are added in the Support Packages and Patches section of this note. The "Support Packages & Patches" section will be populated with the relevant patch levels once they are released.
Enabling the flag might cause side effects with Workbench functionality. This flag is only meant for production environments where the Workbench is not used.
Reason and prerequisites
This vulnerability is exploitable only when a call to Illuminator Servlet is made from a custom implementation.
CVSS
Score 6.3 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Affected components
- XMII: versions 15.0, 15.1, 15.2
- MII_ADMIN: versions 15.0, 15.1, 15.2
Full note on SAP: SAP Support Launchpad note 2686535
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].