Unauthorized use of app. functions in CERTREQ and CERTMAP, SAP security note 1593433

SAP security note 1593433, "Unauthorized use of app. functions in CERTREQ and CERTMAP". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

An attacker can execute functions in the BSP applications CERTREQ and CERTMAP without authentication and authorization.

Solution

• For additional information and instructions, see Note 1520324. The corrections from Note 1520324 are a prerequisite for implementing this note.
• Implement the automatic correction instructions provided in this note. Then follow the instructions from the manual correction.

Reason and prerequisites

The BSP applications CERTREQ and CERTMAP execute certain functions by referencing specific URLs. When an attacker tricks an authenticated user’s browser into making a request containing a certain URL and specific parameters, the function is executed with the rights of the authenticated user. The attacker may use a cross-site scripting attack to do this, or they may present a link to the victim.

References

Affected components

• SAP_BASIS: 640, 700-702, 710-731