SAP security note 1522247, "Unauthorized usage of application functionality in DMS", is a note. Below are the symptom and SAP recommended solution.
Description
Symptom
A malicious user can trigger functionality in the services CVW1, CVW3, CVW3A, CVW4, CVW4A, CVWG, DVS_FAVORITE_1, SHOW_DOCS_1, CVWD, CVSE_MAINTAIN, and CVSE_SEARCH without authentication and authorization.
Solution
Implement the changes provided in this note. For release 605 of SAP_APPL, follow these steps:
- Start transaction SICF.
- For each affected service, enter the service name and execute SICF (the services are found under the path /sap/bc/gui/sap/its/<service>).
- Double-click the service name in the tree and switch to change mode.
- Select the GUI Configuration.
- Add the parameter ~XSRFCHECK with the value 1.
- Save the settings.
- Prerequisite: implement SAP Note 1481392 before applying the changes in this note.
Reason and prerequisites
The services mentioned above execute certain functions by referencing specific URLs. An attacker can trick an authenticated user’s browser into making a request containing a certain URL and specific parameters, causing the function to execute with the user’s privileges. This can be achieved through Cross-Site Scripting (XSS) attacks or by presenting a malicious link for the victim to click.
Full note on SAP: SAP Support Launchpad note 1522247
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].