Unauthorized execution of functions in Web Survey, SAP security note 1468513

SAP security note 1468513, "Unauthorized execution of functions in Web Survey", is a program error note released on June 24, 2011. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

This security note has been updated. For details, see security note 1603701.

1. An attacker can execute Web Survey functions without the relevant authentication and authorization.

2. The Web Survey could be abused by a malicious user, who could modify displayed application content without authorization and potentially obtain authentication information from other legitimate users.

Solution

• For more information and instructions, see Note 1520324. Before you implement this note, you must implement the corrections contained in Note 1520324 in your system.
• Implement the attached correction instructions that correspond to your release. As a result, the report BSP_XSRF_PARAM_UWS_FORM is also created in your system.
• Execute the report BSP_XSRF_PARAM_UWS_FORM and when requested, specify a relevant transport request number. The report fills the database table BSPTEMPXSRFSTORE with the relevant table entries for BSP applications that are adjusted by this note.

Reason and prerequisites

1. A Web Survey executes functions by calling certain URLs with parameters. If an attacker succeeds in getting the browser of a logged-on user to execute arbitrary inquiries, the attacker can call functions in the Web Survey with the rights of the user. To do so, an attacker can exploit a cross-site scripting vulnerability or introduce a special link to the user in the form of an e-mail, for example.

2. Since there is no sufficient input validation by BSP in Web Survey, this results in a reflected cross-site scripting issue. A reflected cross-site scripting attack can be used to non-permanently deface or modify displayed content from a web site. Reflected cross-site scripting can be used to steal another user’s authentication information, such as data relating to their current session. An attacker who gains access to this data could use it to impersonate the user and access all information with the same rights as the target user. If an administrator is impersonated, the application’s security could be fully compromised.

References

• 1607006 – Survey: "CALLED_BY_PUBLIC_SERVICE" in BSP application
• 1609287 – Unauthorized modification of displayed content in Websurvey
• 1603701 – Update #1 to Security Note 1468513
• 1540729 – ASU content for activating XSRF protection for BSP
• 1520324 – Advance creation of XSRF information
• 887168 – BSP Page Directive <%@page forceEncode="html"%> & <%html=%>

Affected components

• SAP_ABA: 620, 640, 700 to 702, 710 to 711, 730