High priority
SAP security note 1586927, "Unauthorized Use of Application Functions in BROWSE_PLANE", is a program error note released on July 12, 2011. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
A malicious user can execute functions in BROWSE_PLANE without authentication and authorization.
Solution
- Delete the BSP Application: Remove the BROWSE_PLANE BSP application from your SAP system.
- Delete the SICF Node: Remove the SICF node located at sap/bc/bsp/sap/browse_plane.
Reason and prerequisites
BROWSE_PLANE executes certain functions by referencing specific URLs. When a malicious user tricks an authenticated user’s browser into making a request with a specific URL and parameters, the function executes with the user’s permissions. This can be achieved through cross-site request forgery (XSRF) attacks or by presenting malicious links to the victim.
Affected components
- BC-WD-CMP-FPM 701
- BC-WD-CMP-FPM 702
- BC-WD-CMP-FPM 711
- BC-WD-CMP-FPM 720
- BC-WD-CMP-FPM 730
Full note on SAP: SAP Support Launchpad note 1586927
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].