Unauthorized use of application functions in Codepage Fct., SAP security note 1586718

SAP security note 1586718, "Unauthorized Use of Application Functions in Codepage Fct.", is a program error note released on August 9, 2011. Below are the symptom and SAP recommended solution.

Description

Symptom

A malicious user can execute functions in codepage functionality without proper authentication and authorization.

Solution

1. Apply the Relevant Support Package: Ensure that you have applied the support package mentioned in this note or follow the respective manual correction instructions.

2. Manual Correction Instructions: Prerequisite: Implement SAP Note 1520324 before proceeding with these manual steps.

Affected BSP Applications:

• DOCX_TEST_FORMS in package S_OOXML_DOCX_FORM
• XSLFO_MIME in package S_XSLFO_SUPPLEMENTARY
• SCPBSPCONVERTUC in package SCP

Steps for all affected BSP applications: go to transaction SE80, open the relevant package, expand BSP Library, expand BSP Applications, double-click the specific application object, navigate to the Properties tab, switch to Write mode, enable XSRF Protection, then save and activate the changes.

Additional steps for SCPBSPCONVERTUC: after completing the above steps, expand SCPBSPCONVERTUC, expand Pages with Flow Logic, double-click default.htm, go to the Properties tab, switch to Write mode, enable Start BSP, then save and activate the changes.

If any of the above BSP applications are missing in your system, no action is required.

Reason and prerequisites

The vulnerability arises because certain codepage functions are executed by referencing specific URLs. An attacker can trick an authenticated user’s browser into making a request with these URLs and parameters, causing the function to execute with the user’s privileges. This can be exploited via cross-site scripting (XSS) attacks or by simply presenting a malicious link to the victim.

References

• 1520324 – Advance creation of XSRF information