SAP Security Note
High priority
SAP security note 1600585, "Unauthorized use of application functions in PA-EC", is a program error note released on 11.10.2011. Below are the symptom and SAP recommended solution.
Description
Symptom
A malicious user can execute functions in PA-EC without authentication and authorization.
Solution
Import the relevant Support Package.
Reason and prerequisites
PA-EC executes certain functions by referencing specific URLs. When a malicious user tricks an authenticated user’s browser into making a request containing a specific URL and parameters, the function is executed with the user’s rights. This can be achieved through cross-site scripting (XSS) attacks or by presenting a crafted link to the victim.
References
Full note on SAP: SAP Support Launchpad note 1600585
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
