Unauthorized use of application functions in personalization, SAP security note 1669901

SAP security note 1669901, “Unauthorized use of application functions in personalization”, is released on 13.03.2012. Below are the symptom and SAP recommended solution.

Description

Symptom

An attacker can execute functions in Portal personalization functionality without authentication and authorization.

Solution

Implement the XSRF protection implemented in the HTMLB framework by Portal personalization functionalities. Portal personalization functionality implemented in Web Dynpro Java is XSRF safe due to the protection in the Web Dynpro Java runtime framework. Refer to SAP Note 1327872.

To apply the solution, apply the relevant patch from the “SP Patch Level” tab.

Reason and prerequisites

Reason: Portal personalization executes certain functions by referencing specific URLs. When an attacker tricks an authenticated user’s browser into making a request containing a certain URL and specific parameters, the function is executed with the rights of the authenticated user. The attacker may use a cross-site scripting attack or present a malicious link to the victim.

Prerequisites:

• Using SAP NW Portal in releases lower than:
  • SAP NW Portal 7.00 SP27
  • SAP NW Portal 7.01 SP12
  • SAP NW Portal 7.02 SP12
  • SAP NW Portal 7.30 SP7
  • SAP NW Portal 7.31 SP3
• XSRF protection is enabled in the J2EE engine

References

• Central Note for Portal Platform in SAP NW7.0 EhP2 SP12
• Central Note for Portal Platform in SAP NW7.0 EhP1 SP12
• Central Note for Portal Platform in SAP NW7.0 SP27
• Central Note for NetWeaver 7.31 SP03 EP / EPC
• Central Note for NetWeaver 7.30 SP07 EP / EPC