SAP security note 1635555, "Unauthorized Use of Application Functions in ERMS". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
A malicious user can execute functions in CRM-IC-EMS without authentication and authorization.
Solution
1. Refer to prerequisite Note 1520324 and Note 1551982. These notes provide additional information and instructions. Implementing the corrections from these notes is a prerequisite for applying this security note.
2. Implement the correction instructions provided in this note. This process will create the report BSP_XSRF_PARAM_CRM_IC_EMS in your system.
3. Run the report BSP_XSRF_PARAM_CRM_IC_EMS and specify a corresponding transport request number when prompted. This will activate XSRF protection for the BSP applications modified by this note.
Reason and prerequisites
ERMS executes certain functions by referencing specific URLs. When a malicious user tricks an authenticated user’s browser into making a request containing a specific URL and parameters, the function is executed with the rights of the authenticated user. This can be achieved via cross-site scripting attacks or by presenting a deceptive link to the victim.
References
Affected components
- Customer Relationship Management (CRM)
- Interaction Center WebClient (CRM-IC)
- E-Mail Response Management System (CRM-IC-EMS)
Full note on SAP: SAP Support Launchpad note 1635555
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
