Unauthorized usage of application functionality in FSCM_BD, SAP security note 1537670

SAP security note 1537670, "Unauthorized usage of application functionality in FSCM_BD", is a note released on 14.12.2010. Below are the symptom and the SAP recommended solution.

Description

Symptom

An unauthorized user can trigger functionality in FSCM_BD on behalf of an unsuspecting authorized user.

Solution

To mitigate XSRF attacks, web applications must ensure that state-changing operations do not rely solely on credentials or tokens automatically submitted by browsers. A common approach is to include a special token in each request, associated with the user session and valid for the session lifetime.

The SAP NetWeaver Application Server Java (AS Java) has been enhanced with the XSRF Protection Framework. Secure your web application with the token-based approach by adopting this framework. This note provides the adoption steps for the XSRF Protection Framework specific to FSCM_BD.

• Apply prerequisite note: ensure Note 1509214 is applied before proceeding.
• Refer to required notes: Note 1450166 for details on the availability of the XSRF Protection Framework, and the SAP XSRF Protection Guide attached to the same note for an overall understanding of the XSRF protection procedure.
• Affected JSP pages in FSCM_BD_604 and lower BD releases: content_activitySearch_html.jsp, content_downloadFormatChoose_html.jsp, content_custExtension_html.jsp, content_info_html.jsp, content_comp_user_show_html.jsp.
• Manual protection for the JSP page content_comp_user_edit_html.jsp: add manual XSRF protection by declaring the XSRF protector and inserting the resulting hidden field into the form.

  <%
      com.sap.xsrf.XSRFProtector xsrfProtector = com.sap.xsrf.XSRFProtectorFactory.getInstance();
      String hiddenXsrfField = xsrfProtector.getXsrfEncodedFormField("/", true, request);
  %>
  
  <form method="post" name="frmPartnerInfo" action="">
      <%=hiddenXsrfField%>
  </form>

• Obsolete JSP pages: content_suss_credits_html.jsp, content_suss_invoices_html.jsp, content_suss_payments_html.jsp.

Reason and prerequisites

FSCM_BD executes state-changing functionality via referencing URLs. In certain scenarios, it is possible for an unauthorized and unauthenticated third party to trigger this functionality on behalf of an authorized authenticated user without their knowledge or consent. Please refer to Note 1509214 as a prerequisite.

References

• 1597549 – Unauthorized modification of displayed content in FSCM_BD
• 1515190 – Composite SAP Note: Security of SAP Biller Direct
• 1509214 – Unauthorized usage of application functionality in FSCM_BD