Unauthorized usage of application functionality in MSS 60.1, SAP security note 1526079

SAP security note 1526079, “Unauthorized usage of application functionality in MSS 60.1”, released on 14.12.2010. Below are the symptom and SAP recommended solution.

Description

Symptom

A malicious user can trigger functionality in Manager Self Service (MSS) 60.1 without authentication and authorization.

Solution

To enable XSRF protection, update your J2EE Server based on NW/645 with the appropriate Support Package Level on both application and basis sides. Deploy the following Minimum Support Packages to your system:

• MSS: BPMSS601_23
• J2EE: NW645/SP22

Note that Patch 23 of MSS 60.1 includes updates specifically for XSRF protection. Starting with Patch 23, all upcoming Support Packages for MSS will require at least NW Basis on SP level 22 or higher.

Reason and prerequisites

Manager Self Service (MSS) 60.1 executes certain functions by referencing specific URLs. When an attacker tricks an authenticated user’s browser into making a request containing a specific URL and parameters, the function is executed with the user’s permissions. Attackers may use a Cross Site Scripting (XSS) attack to trigger the exploit or present a clickable link to the victim.