Unauthorized use of application functions in CRM-MKT-MPL-CAL, SAP security note 1593061

SAP security note 1593061, "Unauthorized use of application functions in CRM-MKT-MPL-CAL". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

A malicious user can execute functions in CRM-MKT-MPL-CAL without authentication and authorization.

Solution

1. Refer to Notes 1520324 and 1551982 for additional information and instructions. The corrections from these notes are prerequisites for implementing this note.
2. Implement the correction instructions of this note. This will create the report BSP_XSRF_PARAM_CRM_MKT_CAL in your system.
3. Execute the report BSP_XSRF_PARAM_CRM_MKT_CAL and specify a corresponding transport request number when prompted. The report will activate XSRF protection for the BSP applications adapted by this note.

Reason and prerequisites

CRM-MKT-MPL-CAL executes certain functions by referencing specific URLs. When a malicious user tricks an authenticated user’s browser into making a request containing a certain URL and specific parameters, the function is executed with the rights of the authenticated user. The malicious user may use a cross-site scripting attack to achieve this or present a link to the victim.

Affected components

• BBPCRM 500
• BBPCRM 520
• BBPCRM 600
• BBPCRM 700
• BBPCRM 701
• BBPCRM 702
• BBPCRM 712