Unauthorized use of application functions in FIN-SEM-CPM, SAP security note 1590927

SAP security note 1590927, “Unauthorized use of application functions in FIN-SEM-CPM”, is a program error note released on December 13, 2011. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

An attacker can execute functions in FIN-SEM-CPM without authentication and authorization.

Solution

• For additional information and instructions, see Note 1520324. The corrections from Note 1520324 are a prerequisite for implementing this note.
• Implement the correction instructions provided in this note. Create the report ZBSP_XSRF_PARAM_FIN_SEM_CPM2 as a local object in your system.
• Execute the report ZBSP_XSRF_PARAM_FIN_SEM_CPM2 and when requested, specify a relevant transport request number. The report will fill the database table BSPTEMPXSRFSTORE with relevant table entries for the BSP applications adapted by this note.

Reason and prerequisites

FIN-SEM-CPM executes certain functions by referencing specific URLs. When an attacker tricks an authenticated user’s browser into making a request containing a certain URL and specific parameters, the function is executed with the rights of the authenticated user. The attacker may use a cross-site scripting attack to do this, or they may present a link to the victim.

Affected components

• SEM-BW (versions 400, 600, 602, 603, 604, 605, 634, 700)