Unauthorized usage of ME_SWP services, SAP security note 1531512

SAP security note 1531512, "Unauthorized usage of ME_SWP services". Below are the symptom and SAP recommended solution.

Description

Symptom

A malicious user can trigger functionalities in the Supplier Workplace services without authentication and authorization. The user can perform actions for which they have no authorization.

The following services can be affected and have now been protected:

• ME_SWP_ALERT
• ME_SWP_SRI
• ME_SWP_IV
• ME_SWP_PDI
• ME_SWP_PH
• ME_SWP_CO
• ME_SWP
• ME_SWP_GUI

Solution

Manual Steps for customers on EHP5 release:

• Start transaction SICF.
• Process the following steps for each service mentioned above:
  • Enter the name and the service and execute SICF (You will find the services in SICF under the path /sap/bc/gui/sap/its/<service>).
  • Double click on the service name in the tree and switch to the change mode.
  • Choose the GUI configuration.
  • Add the parameter ~XSRFCHECK with value 1.
  • Save the settings.

Note the following:

• Refer to note 1481392 for additional information and instructions. The corrections from note 1481392 are a prerequisite for implementation of this note.
• Implement the correction instructions of this note. This will also create the report ITS_XSRF_PARAM_604_1 in your system.
• Execute the report ITS_XSRF_PARAM_604_1 and specify a corresponding transport request number when requested. The report will add service parameters for the adapted ITS services (maintained via the GUI configuration pushbutton for a service within transaction SICF).

Please note that against each release, the report will appear with the prefix ITS_XSRF_PARAM_… based on which release it is being applied for.

Reason and prerequisites

SWP services execute certain functions through their respective referencing URLs. When an attacker tricks an authenticated user’s browser into making a request containing a certain URL and specific parameters, the function is executed with the rights of the user. If present, the attacker may use a Cross Site Scripting attack to trigger the exploit or use an approach in which a link to click is presented to the victim.