PI SEC Unauthorized use of administrative functions in PI, SAP security note 1592426

SAP security note 1592426, "PI SEC: Unauthorized use of administrative functions in PI", is a note. Below are the symptom and SAP recommended solution.

Description

Symptom

A malicious user can execute functions in NW PI Adapter Framework without authentication and authorization.

Solution

This issue is fixed with the referenced Support Packages and Patches of the following Software Components:

• XI ADAPTER FRAMEWORK (SAP_XIAF)
• XI TOOLS (SAPXITOOL)
• SAP_BASIS

Reason and prerequisites

PI Adapter Framework executes certain functions by referencing specific URLs. When a malicious user tricks an authenticated user’s browser into making a request containing a certain URL and specific parameters, the function is executed with the rights of the authenticated user. The malicious user may use a cross-site scripting attack to do this, or they may present a link to the victim.

As part of the changes, the ABAP role SAP_XI_ID_SERV_USER was enhanced with the authorization object S_ICF and attributes ICF_FIELD=SERVICE, ICF_VALUE=XICACHE.