Unauthorized use of application functions in CRM-BF-SVY, SAP security note 1591057

SAP security note 1591057, "Unauthorized use of application functions in CRM-BF-SVY", is a program error note released on 08.11.2011. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

CRM-BF-SVY executes certain functions by referencing specific URLs. When a malicious user tricks an authenticated user’s browser into making a request containing a certain URL and specific parameters, the function is executed with the rights of the authenticated user. This can be achieved through a cross-site scripting (XSS) attack or by presenting a crafted link to the victim.

Solution

• Prerequisites: refer to Note 1520324 and Note 1551982 for additional information and instructions. The corrections from these notes are prerequisites for implementing this note.
• Implement correction instructions: follow the correction instructions provided in this note. This will create the report BSP_XSRF_PARAM_CRM_BF_SVY in your system.
• Activate XSRF protection: execute the report BSP_XSRF_PARAM_CRM_BF_SVY. When prompted, specify a corresponding transport request number. This report will activate the XSRF protection for the BSP applications adapted by this note.

Side effects: this document is causing side effects in Note 1816204 – SVY: Dump while using SICF user for Survey BSP URL.

References

Affected components

• BBPCRM