Unauthorized use of application functions in CRM-BTX-SVO, SAP security note 1593320

SAP security note 1593320, "Unauthorized use of application functions in CRM-BTX-SVO", is a program error note released on 08.11.2011. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

A malicious user can execute functions in CRM-BTX-SVO without authentication and authorization.

Solution

1. Refer to Note 1520324 and Note 1551982 for additional information and instructions. The corrections from these notes are prerequisites for implementation of this note.
2. Implement the correction instructions of this note. This will also create the report BSP_XSRF_PARAM_CRM_BTX_SVO in your system.
3. Execute the report BSP_XSRF_PARAM_CRM_BTX_SVO and specify a corresponding transport request number when requested. The report will activate the XSRF protection for the BSP applications adapted by this note.

Reason and prerequisites

CRM-BTX-SVO executes certain functions by referencing specific URLs. When a malicious user tricks an authenticated user’s browser into making a request containing a certain URL and specific parameters, the function is executed with the rights of the authenticated user. The malicious user may use a cross-site scripting attack to do this, or they may present a link to the victim.

Affected components

• BBPCRM 500
• BBPCRM 520
• BBPCRM 600
• BBPCRM 700
• BBPCRM 701