SAP Security Note
High priority
SAP security note 1620044, "KM UI vulnerable to CSRF attacks", is a note released on February 14, 2012. Below are the symptom, SAP recommended solution and reason and prerequisites.
Description
Symptom
A malicious user can execute functions in KM UI without authentication and authorization.
Solution
Refer to the Support Package patch level section of this SAP note for details. Important: before applying this note, ensure that the following notes are already applied: 1129816 and 1450166.
Reason and prerequisites
KM UI executes certain functions by referencing specific URLs or via POST requests. When a malicious user tricks an authenticated user’s browser into making a request containing certain URLs or executing a POST request with specific parameters, the function is executed with the rights of the authenticated user. This can be achieved through cross-site scripting (XSS) attacks or by presenting a link to the victim.
References
- 1676329 – KMC in EHP1 for SAP NetWeaver 7.0 SPS11 – Add-on
- 1645146 – Certain service calls can be executed though URL
- 1637611 – CSRF vulnerability in Web Page Composer
- 1450166 – Unauthorized usage of application functionality
- 1129816 – New facade for referring XSRF library in SAP NetWeaver 7.30
Full note on SAP: SAP Support Launchpad note 1620044
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
