Unauthorized use of application functionality in CA-GTF-PCF, SAP security note 1589674

SAP security note 1589674, "Unauthorized use of application functionality in CA-GTF-PCF", is a program error note released on 11.11.2011. Below are the symptom and SAP recommended solution.

Description

Symptom

A malicious user can trigger functionality in CA-GTF-PCF without authentication and authorization.

Solution

For the stateless BSP applications:

CRM_BSP_FACE, CRM_ML_PREVIEW, CRM_PREVIEW, CRM_BSP_FRAME, crm_xml_test, crm_bsp_bab_fra, CRM_BSP_BAB_PAN, CRM_BSP_XBAB_FR, CRM_BSP_XBAB_PA, CRM_BSP_F1_HELP, CRM_BSP_F4_HELP, CRM_BSP_LISTPER, crm_bsp_bab_dis, CRM_BSP_BAB_DSS, CRM_PRT_URL_DIS, CRM_BSP_LST_PRT

• Refer to Note 1520324 and Note 1551982 for additional information and instructions. The corrections from these notes are prerequisites for the implementation of this note.
• Implement the correction instructions of this note. This will create the report BSP_XSRF_PARAM_CA_GTF_PCF in your system.
• Execute the report BSP_XSRF_PARAM_CA_GTF_PCF and specify a corresponding transport request number when prompted. The report will activate the XSRF protection for the BSP applications adapted by this note.

Reason and prerequisites

CA-GTF-PCF executes certain functions by referencing specific URLs. When a malicious user tricks an authenticated user’s browser into making a request containing a certain URL and specific parameters, the function is executed with the rights of the authenticated user. The malicious user may use a cross-site scripting attack to do this, or they may present a link to the victim.