Unauthorized use of application functions in CRM-ISE-WBF, SAP security note 1618640

SAP security note 1618640, “Unauthorized use of application functions in CRM-ISE-WBF”, is a note released on 13.12.2011. Below are the symptom and SAP recommended solution.

Description

Symptom

A malicious user can execute functions in CRM-ISE-WBF, CRM-ISE-SRE, CRM-ISE-UAD without authentication and authorization.

Solution

• Refer to note 1520324 and note 1551982 for additional information and instructions. The corrections from these notes are a prerequisite for implementing this note.
• Implement the correction instructions of this note. This will also create the report BSP_XSRF_PARAM_CRM_ISE_WBF in your system.
• Execute the report BSP_XSRF_PARAM_CRM_ISE_WBF and specify a corresponding transport request number when prompted. The report will activate the XSRF protection for the BSP applications adapted by this note.

Reason and prerequisites

CRM-ISE-WBF, CRM-ISE-SRE, CRM-ISE-UAD execute certain functions by referencing specific URLs. When a malicious user tricks an authenticated user’s browser into making a request containing a certain URL and specific parameters, the function is executed with the rights of the authenticated user. The malicious user may use a cross-site scripting attack to do this, or they may present a link to the victim.

References

• 1551982 – Cross-site request forgery protection for stateless
• 1520324 – Advance creation of XSRF information