Unauthorized usage of application functionality in FI-AR/AP, SAP security note 1507940

SAP security note 1507940, “Unauthorized usage of application functionality in FI-AR/AP”, is a note. Below are the symptom, reason and prerequisites, SAP recommended solution, references and the affected software components.

Description

Symptom

A malicious user can trigger functionality in FI-AR/FI-AP without authentication and authorization.

Solution

• Refer to Note 1481392 for additional information and instructions. The corrections from note 1481392 are a prerequisite for implementation of this note.
• Implement the correction instructions of this note. This will also create the report ITS_XSRF_PARAM__FIAP_AR_ALL of the application component in your system.
• Execute the report ITS_XSRF_PARAM_FIAP_AR_ALL of the application component and specify a corresponding transport request number when requested. The report will add service parameters for the adapted ITS services (maintained via the GUI configuration pushbutton for a service within transaction SICF).

Reason and prerequisites

FI-AR/FI-AP executes certain functions through referencing specific URLs. When an attacker tricks an authenticated user’s browser into making a request containing a certain URL and specific parameters, the function is executed with the rights of the user.

If present, the attacker may use a Cross Site Scripting attack to trigger the exploit, or use an approach in which a link to click is presented to the victim.

References

Affected components

• SAP_APPL (500, 600, 602, 603, 604, 605)