Unauthorized use of application functions in MSON, SAP security note 1841786

SAP security note 1841786, “Unauthorized use of application functions in MSON”. Below are the symptom and SAP recommended solution.

Description

Symptom

An attacker can execute functions in XAP-MBA-MSO without authentication and authorization.

Solution

The RIM SSO Authentication components and modules were created for an older version of NetWeaver, and this module is irrelevant with the newer versions of NetWeaver 7.0x. Hence, the old RIM SSO components are not supported anymore and have been replaced by the NetWeaver functionality.

The SSO functionality from MSON has been replaced by NetWeaver SSO.

Kindly refer to the SAP Note 1919464 for steps to undeploy the RIMLoginModule component.

Reason and prerequisites

XAP-MBA-MSO executes certain functions by referencing specific URLs. When an attacker tricks an authenticated user’s browser into making a request containing a certain URL and specific parameters, the function is executed with the rights of the authenticated user. The attacker may use a cross-site scripting attack to do this, or they may present a link to the victim.

CVSS

Score 6.0 Vector: AV:N/AC:M/AU:S/C:P/I:P/A:P