SAP security note 1509214, “Unauthorized usage of application functionality in FSCM_BD”, is a note. Below are the symptom, reason and prerequisites, SAP recommended solution, references and the affected software components.
Description
Symptom
An unauthorized user can trigger functionality in FSCM_BD on behalf of an unsuspecting authorized user.
Solution
XSRF attacks have to be addressed inside web applications. These applications must ensure that for state-changing operations they are not relying only on credentials or tokens that are automatically submitted by browsers. A common approach is including a special token in each request, which is associated with the user session and is valid only for the session lifetime.
The SAP NetWeaver Application Server Java (AS Java) has been enhanced with the XSRF Protection Framework. You can secure your web-application with the token-based approach by adopting the framework. This note contains the adoption of the XSRF Protection Framework for FSCM_BD.
Please refer to SAP Note 1450166 for details regarding availability. To enable XSRF protection for FSCM_BD, apply the above-mentioned Note before following the steps outlined in this Note. Additionally, refer to the SAP XSRF Protection Guide to gain an overall understanding of the XSRF protection procedure.
Reason and prerequisites
FSCM_BD executes state-changing functionality via referencing URLs. In certain scenarios, it is possible for an unauthorized and unauthenticated third party to trigger this functionality on behalf of an authorized authenticated user without the latter’s knowledge and/or consent.
References
- SAP Note 1597549 – Unauthorized modification of displayed content in FSCM_BD
- SAP Note 1537670 – Unauthorized usage of application functionality in FSCM_BD
- SAP Note 1516177 – XSRFJava: Adopt API-PSI Utility Customer E-Services
- SAP Note 1515190 – Composite SAP Note: Security of SAP Biller Direct
- SAP Note 1450166 – Unauthorized usage of application functionality
Affected components
- FSCM_BD (300, 600, 602, 604, 605)
Full note on SAP: SAP Support Launchpad note 1509214
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
