SAP security note 1495421, “Unauthorized usage of application functionality in ISE”, is a note. Below are the symptom, SAP recommended solution and affected software components.
Description
Symptom
A malicious user can trigger functionality in Interactive Scripting Editor without authentication and authorization.
Solution
The issue can be fixed by applying the attached correction request. The solution is to escape the URL referred by the Interactive Scripting Editor.
- CRM 4.0 with SAP BASIS 620: check the correction instructions for BBPCRM 4.0 and apply the corresponding changes in the BSP pages mentioned in the correction instruction. SNOTE is not capable of implementing the changes automatically.
Reason and prerequisites
The interactive scripting editor executes certain functions through referencing specific URLs. When an attacker tricks an authenticated user’s browser into making a request containing a certain URL and specific parameters, the function is executed with the rights of the user.
If present, the attacker may use a Cross Site Scripting attack to trigger the exploit, or use an approach in which a link to click is presented to the victim.
Affected components
- CRM-IC-SCR: 400
- CRMUIF: 520, 600
- WEBCUIF: 700, 701, 730
- SAP_ABA: 700
- CRMIS: 400
- BBPCRM: 400
Full note on SAP: SAP Support Launchpad note 1495421
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].