SAP security note 1510881, “Unauthorized usage of Utility-application functionality”. Below are the symptom, reason and prerequisites, the SAP recommended solution and the affected software components.
Description
Symptom
A malicious user can trigger functionality in the Utility PC-UI applications without authentication and authorization.
Solution
The issue can be fixed by applying the attached manual correction instructions.
Reason and prerequisites
The Utility PC-UI application executes certain functions through referencing specific URLs. When an attacker tricks an authenticated user’s browser into making a request containing a certain URL and specific parameters, the function is executed with the rights of the user.
If present, the attacker may use a Cross Site Scripting attack to trigger the exploit, or use an approach in which a link to click is presented to the victim.
References
- SAP Note 1540729 – ASU content for activating XSRF protection for BSP
- SAP Note 1520324 – Advance creation of XSRF information
Affected components
- BBPCRM 400
- BBPCRM 500
- BBPCRM 520
- BBPCRM 600
- BBPCRM 700
- BBPCRM 701
Full note on SAP: SAP Support Launchpad note 1510881
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
