SAP security note 1589611, "SEC-207_3 XSRF Adaption for NW BSP Stateless Apps (IMS)", addresses a security vulnerability affecting SAP systems. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
A malicious user can trigger functionality in BC-SRV-KPR without proper authentication and authorization.
Solution
- Refer to Prerequisite Notes: Ensure that notes 1520324 and 1551982 are implemented, as they are prerequisites for this correction.
- Implement Correction Instructions: Follow the correction instructions provided in this note to create the report BSP_XSRF_PARAM_BC_SRV_KPR in your system.
- Execute the Report: Run the report BSP_XSRF_PARAM_BC_SRV_KPR and provide the requested transport request number when prompted. This will activate XSRF protection for the BSP applications affected by this note.
Reason and prerequisites
BC-SRV-KPR executes certain functions by referencing specific URLs and parameters. An attacker can trick an authenticated user’s browser into making a request with a crafted URL and parameters, causing the function to execute with the user’s privileges. Techniques such as Cross Site Scripting (XSS) can be used to exploit this vulnerability, or by presenting a malicious link for the victim to click.
Affected components
- SAP_BASIS versions 620 to 731
Full note on SAP: SAP Support Launchpad note 1589611
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].