Unauthorized use of application functions in CRM-IPS-BTX-APL, SAP security note 1593702

SAP security note 1593702, "Unauthorized use of application functions in CRM-IPS-BTX-APL", is a note. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

A malicious user can execute functions in CRM-IPS-BTX-APL without authentication and authorization.

Solution

1. Refer to SAP Notes 1520324 and 1551982: These notes contain additional information and instructions. The corrections from these notes are prerequisites for implementing this note.
2. Implement the Correction Instructions of this note. This will create the report BSP_XSRF_PARAM_CRM_IPS_BTX in your system.
3. Execute the report BSP_XSRF_PARAM_CRM_IPS_BTX: when prompted, specify a corresponding transport request number. This report will activate the XSRF protection for the BSP applications adapted by this note.

Reason and prerequisites

CRM-IPS-BTX-APL executes certain functions by referencing specific URLs. When a malicious user tricks an authenticated user’s browser into making a request containing a certain URL and specific parameters, the function is executed with the rights of the authenticated user. This can be achieved through a cross-site scripting attack or by presenting a crafted link to the victim.

Affected components

• BBPCRM 500
• BBPCRM 520
• BBPCRM 600
• BBPCRM 700
• BBPCRM 701
• BBPCRM 702
• BBPCRM 712