Unauthorized use of application functions in IS-AFS, SAP security note 1525149

SAP security note 1525149, "Unauthorized use of application functions in IS-AFS". Below are the symptom and SAP recommended solution.

Description

Symptom

A malicious user can execute functions in IS-AFS without authentication and authorization.

Solution

• For additional information and instructions, see Note 1481392. The corrections from Note 1481392 are a prerequisite for implementing this note.
• Implement the correction instructions provided in this note. Create the report /AFS/ITS_XSRF_PARAM_PO_CONF as a local object in your system.
• Execute the report /AFS/ITS_XSRF_PARAM_PO_CONF and when prompted, specify a relevant transport request number. The report will add service parameters for the adapted ITS services (maintained via the GUI configuration pushbutton for a service within transaction SICF).

Reason and prerequisites

IS-AFS executes certain functions by referencing specific URLs. When a malicious user tricks an authenticated user's browser into making a request containing a certain URL and specific parameters, the function is executed with the rights of the authenticated user. The malicious user may use a cross-site scripting attack to achieve this, or they may present a link to the victim.