Unauthorized usage of application functionality, SAP security note 1514717

SAP security note 1514717, "Unauthorized usage of application functionality", is a note. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

A malicious user can trigger functionality in the following BSP applications without authentication and authorization:

• BBP_SUS_UM
• BBP_SUS_WORKER
• CRM_BSP_PSD_CHM
• CRM_SEND_SCREEN

Solution

• Manual pre-implementation steps for CRM Release 7.01 and lower: for CRM 7.01, implement the attached corrections from the note; for lower releases, follow the manual steps provided in the note.
• Enable XSRF protection on BSP applications: in transaction SE80, edit each affected BSP application (BBP_SUS_UM, BBP_SUS_WORKER, CRM_BSP_PSD_CHM, CRM_SEND_SCREEN), mark the checkbox for "XSRF Protection", then save and activate the changes.
• Implement correction instructions: create reports BSP_XSRF_PARAM_CRM_MISC_3_400A (in package CRM_CHM_CM_PRT_F+R) and BSP_XSRF_PARAM_CRM_MISC_3_400B (in package CRM_EMAIL), and maintain both reports as "SAP standard production report".
• Execute reports for manual post-implementation: for CRM 7.0 and lower, execute the reports BSP_XSRF_PARAM_CRM_MISC_3 and BSP_XSRF_PARAM_CRM_MISC_3_400A/B, specifying a corresponding transport request number when prompted; these reports populate the database table BSPTEMPXSRFSTORE with the necessary entries. If upgraded to a basis support package containing Note 1520324, the BSP metadata repository is automatically populated with the correct data, eliminating the need for manual table entries.

Reason and prerequisites

The mentioned BSP applications execute certain functions through specific URLs. An attacker can trick an authenticated user’s browser into making a request containing a certain URL and specific parameters, causing the function to execute with the user’s privileges. This can be achieved through a Cross Site Scripting (XSS) attack or by presenting a clickable link to the victim.

References

• ASU content for activating XSRF protection for BSP

Affected components

• BBPCRM (Releases 400 to 701)
• CRMIS (Release 400)