Unauthorized usage of application functionality agency coll., SAP security note 1509886

SAP security note 1509886, "Unauthorized usage of application functionality agency coll.". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

A malicious user can trigger functionality in the Italian agency collection within FS-CD without proper authentication and authorization.

This vulnerability affects customers using FS-CD (software component INSURANCE) and the Italian agency collection (BSP application ITAGCY). Unauthorized actions can be performed with the rights of an authenticated user, potentially leading to data breaches or unauthorized operations.

Solution

Implement the correction described in this note. For releases below INSURANCE 6.05, follow these steps:

• Prerequisite: Refer to SAP Note 1520324 for additional information and instructions. Ensure that the corrections from this note are applied as they are prerequisites for implementing Note 1509886.
• Apply Corrections: Follow the correction instructions provided in Correction Instructions for Note 1509886. This will create the report BSP_XSRF_PARAM_FSCD in your system.
• Execute Report: Run the report BSP_XSRF_PARAM_FSCD and specify a corresponding transport request number when prompted. This will populate the BSPTEMPXSRFSTORE database table with the necessary entries for the adapted BSP applications.

The solution is incompatible with BSP design 'DESIGN2002'. For the Italian agency collection, the design can be set per user using the user parameter ID_ITAGCY_DESIGN or manually via the BSP application ITAGCY_USERDATA. Refer to SAP Note 1509885 for the BSP design 'DESIGN2008'. Access to the application should only be via the start page index.htm. Access through the controller main.do is no longer supported.

References

• SAP Note 1540729 – ASU content for activating XSRF protection for BSP

Affected components

• INSURANCE (Versions 472, 600, 602, 603, 604, 605) – Italian agency collection in FS-CD