SAP Security Note
High priority
SAP security note 1519463, “Unauthorized usage of application functionality in WCL”, is a program error note released on 20.10.2011. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
This security note has been updated. For more detailed information, see Security Note 1640676.
An unauthorized user can trigger functionality in the Web Communication Layer for Event Management (WCL) on behalf of an unsuspecting authorized user.
Solution
XSRF attacks have to be addressed inside web applications. These applications must ensure that for state-changing operations they are not relying only on credentials or tokens that are automatically submitted by browsers. A common approach is including a special token in each request, which is associated with the user session and is valid only for the session lifetime.
The SAP NetWeaver Application Server Java (AS Java) has been enhanced with the XSRF Protection Framework. You can secure your web application with the token-based approach by adopting the framework. This note contains the adoption of the XSRF Protection Framework for WCL.
SAP’s XSRF Protection Framework is available for specific versions of SAP NetWeaver. Please refer to Note 1450166 for details regarding availability. In order to enable XSRF protection for WCL, please apply the above-mentioned Note prior to undertaking the steps highlighted in this Note. Furthermore, please refer to the SAP XSRF Protection Guide in Note 1450166 to gain an overall understanding of the XSRF protection procedure.
Once you have reviewed the above-mentioned document, please proceed with the detailed steps specific to WCL.
HOW TO ADAPT WCL IN A STANDARD SCENARIO: the solution is implemented in the support package patch levels listed below.
- Download the relevant SP/patch for your release from the SAP Service Marketplace and deploy it on your AS Java.
Reminder: Additionally, you will need to implement NetWeaver patches. You can find the specifics in Note 1450166. Please note that those NetWeaver patches are a prerequisite to implementing the aforementioned WCL support packages.
Reason and prerequisites
WCL (which contains Servlets/JSP pages) executes state-changing functionality via referencing URLs. In certain scenarios, it is possible for an unauthorized and unauthenticated third party to trigger this functionality on behalf of an authorized authenticated user without the latter’s knowledge and/or consent.
References
This note refers to
Affected components
- Supply Chain Management > Event Management > Event Manager (SCM-EM-MGR)
Full note on SAP: SAP Support Launchpad note 1519463
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].