Unauthorized use of application functions in PA-PD-PM, SAP security note 1598381

SAP security note 1598381, “Unauthorized use of application functions in PA-PD-PM”, is a program error note released on 13.12.2011. Below are the symptom and SAP recommended solution.

Description

Symptom

An attacker can execute functions in PA-PD-PM without authentication and authorization.

Solution

• For additional information and instructions, see Note 1520324. The corrections from Note 1520324 are a prerequisite for implementing this note.
• Implement the correction instructions provided in this note. Depending on your release, create the relevant report as a local object in your system.
  • EA-HRGXX 606: ZBSP_XSRF_PARAM_HAP_PA_600
  • EA-HRGXX 605: ZBSP_XSRF_PARAM_HAP_PA_600
  • EA-HRGXX 604: ZBSP_XSRF_PARAM_HAP_PA_600
  • EA-HRGXX 603: ZBSP_XSRF_PARAM_HAP_PA_600
  • EA-HRGXX 602: ZBSP_XSRF_PARAM_HAP_PA_600
  • EA-HRGXX 600: ZBSP_XSRF_PARAM_HAP_PA_600
  • EA-HRGXX 500: ZBSP_XSRF_PARAM_HAP_PA_500
  • EA-HRGXX 200: ZBSP_XSRF_PARAM_HAP_PA_110
  • EA-HRGXX 110: ZBSP_XSRF_PARAM_HAP_PA_110
• Execute the local report and when requested, specify a relevant transport request number. The report will fill the database table BSPTEMPXSRFSTORE with relevant table entries for the BSP applications adapted by this note.

Reason and prerequisites

PA-PD-PM executes certain functions by referencing specific URLs. When an attacker tricks an authenticated user’s browser into making a request containing a certain URL and specific parameters, the function is executed with the rights of the authenticated user. The attacker may use a cross-site scripting attack to do this, or they may present a link to the victim.