SAP security note 1599567, "Unauthorized use of application functions in Dealer portal", is a note. Below are the symptom and SAP recommended solution.
Description
Symptom
An attacker can execute functions in BSP-based Automotive Dealer Portal without authentication and authorization.
Solution
The corrections for XSRF protection are enabled via the Workbench.
For EA-APPL 605 and subsequent lower releases, please follow the manual correction instructions attached.
Please note: refer to SAP Note 1520324 for additional information and instructions, since the corrections from Note 1520324 are a prerequisite for the implementation of this note; then implement the correction instructions of this note.
Reason and prerequisites
The Automotive Dealer Portal executes certain functions by referencing specific URLs. When an attacker tricks an authenticated user’s browser into making a request containing a certain URL and specific parameters, the function is executed with the rights of the authenticated user.
The attacker may use a Cross-Site Scripting (XSS) attack to do this, or they may present a link to the victim.
CVSS
Score 6.8 Vector: AV:N/AC:M/AU:N/C:P/I:P/A:P
References
Full note on SAP: SAP Support Launchpad note 1599567
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
