SAP Note 1450166
High priority
High priority
SAP security note 1450166, "Unauthorized usage of application functionality". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
- Execution of specific application functions via crafted URLs.
- Exploitation through cross-site scripting (XSS) attacks or by presenting malicious links to victims.
Solution
To protect your applications from XSRF attacks:
- Deploy the Latest Patches: Ensure you install the latest patch levels of the Software Component Archives (SCAs) available in the Support Packages & Patches section. This will integrate the XSRF Protection Framework into your system.
- Refer to the Adoption Guide: Download and follow the XSRF Protection Adoption Guide for detailed instructions on implementing the protection measures.
Reason and prerequisites
An unprotected application may allow the execution of certain functions by referencing specific URLs. When a malicious user tricks an authenticated user’s browser into making a request containing a particular URL and specific parameters, the function is executed with the authenticated user’s rights.
CVSS
Score 0
References
Affected components
- ENGINEAPI: Versions 7.10 to 7.30+
- ENGFACADE: Versions 7.11 to 7.20+
- SAP-JEE: Versions 6.40 to 7.02
- SAP_JTECHS: Versions 6.40 to 7.02
- SAP-JEECOR: Versions 6.40 to 7.02
- SERVERCORE: Versions 7.10 to 7.30+
- J2EE-APPS: Versions 7.10 to 7.30+
Full note on SAP: SAP Support Launchpad note 1450166
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].