Unauthorized use of application functions in CA-GTF-IC-SCR, SAP security note 1596226

SAP security note 1596226, "Unauthorized use of application functions in CA-GTF-IC-SCR", is a program error note released on 10.01.2012. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

A malicious user can execute functions in CRM-IC-SEA without authentication and authorization.

Solution

1. Refer to note 1520324 and note 1551982 for additional information and instructions. The corrections from these notes are a prerequisite for implementation of this note.
2. Implement the correction instructions of this note. This will also create the report BSP_XSRF_PARAM_CRM_IC_ISE in your system.
3. Execute the report BSP_XSRF_PARAM_CRM_IC_ISE and specify a corresponding transport request number when requested. The report will activate the XSRF protection for the BSP applications adapted by this note.

Reason and prerequisites

CA-GTF-IC-SCR executes certain functions by referencing specific URLs. When a malicious user tricks an authenticated user’s browser into making a request containing a certain URL and specific parameters, the function is executed with the rights of the authenticated user. The malicious user may use a cross-site scripting attack to do this, or they may present a link to the victim.

CVSS

Score 0

References

• 1737176 – Issue with the update window after closing Scripting editor
• 1495421 – Unauthorized usage of application functionality in ISE
• 1105843 – Scripting Editor JRE1.5 or later support

Affected components

• SAP_ABA 700
• CRMUIF 520
• CRMUIF 600
• WEBCUIF 700
• WEBCUIF 701
• WEBCUIF 730
• WEBCUIF 731
• WEBCUIF 746