SAP security note 1511541 is titled "Unauthorized usage of application functionality of ISR / BSP". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
A malicious user can trigger functionality of BSP based ISR Forms without authentication and authorization.
Solution
- Refer to note 1520324 for additional information and instructions. The corrections from note 1520324 are a prerequisite for implementation of this note.
- Implement the correction instructions of this note. This will also create the reports BSP_XSRF_PARAM_ISR and BSP_XSRF_PARAM_ISR_EA_APPL in your system.
- Execute the reports BSP_XSRF_PARAM_ISR and BSP_XSRF_PARAM_ISR_EA_APPL and specify a corresponding transport request number when prompted. The report will fill the database table BSPTEMPXSRFSTORE with corresponding table entries for the BSP applications adapted by this note.
Reason and prerequisites
ISR executes certain functions through referencing specific URLs. When an attacker tricks an authenticated user’s browser into making a request containing a certain URL and specific parameters, the function is executed with the rights of the user.
If present, the attacker may use a Cross Site Scripting attack to trigger the exploit, or use an approach in which a link to click is presented to the victim.
References
This note refers to
Affected components
- SAP_APPL: Versions 500 to 605
- EA-APPL: Versions 500 to 605
Full note on SAP: SAP Support Launchpad note 1511541
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].