Unauthorized use of appl. functions in Transaction Launcher, SAP security note 1620942

SAP security note 1620942, "Unauthorized Use of Application Functions in Transaction Launcher". Below are the symptom and SAP recommended solution.

Description

Symptom

SAP Security Note 1620942 addresses a vulnerability in the Transaction Launcher of the WebClient UI Framework. A malicious user can execute application functions without proper authentication and authorization by tricking an authenticated user’s browser into making specific requests. A malicious user can exploit this vulnerability by making authenticated requests containing specific URLs and parameters. This allows the execution of functions with the rights of the authenticated user, potentially leading to unauthorized access or actions within the system.

This security issue can lead to unauthorized use of application functions, compromising the integrity and security of the SAP system. It may allow attackers to perform actions that should be restricted, leading to potential data breaches or system misuse.

Solution

• Import the correction: use the Note Assistant (SNOTE) to import the corrections provided by SAP Note 1620942. This ensures that the system performs a whitelist check before executing launch transactions.
• Verify WEBGUI service: import the correction only if the WEBGUI service is active in your system. Check the status in transaction SICF by searching for the service WEBGUI or navigating to default_host/sap/bc/gui/sap/its/webgui.
• Perform manual steps: before importing, carefully execute the manual steps provided in the note. These include changes to message classes, creation of database tables, and updates to function modules.
• Post-implementation: after importing the correction, perform additional manual activities as outlined in the note to ensure full mitigation of the vulnerability.

CVSS

Score 0