High priority
SAP security note 1600530, "Unauthorized use of application functions in PT-RC-UI-XS", is a note released on 14.02.2012. Below are the symptom, SAP recommended solution and reason and prerequisites.
Description
Symptom
An attacker can execute functions in PT-RC-UI-XS without authentication and authorization.
Solution
- For additional information and instructions, see Note 1520324. The corrections from Note 1520324 are a prerequisite for implementing this note.
- Implement the correction instructions provided in this note. Create the report ZBSP_XSRF_PARAM_ESS_LEAVEREQ as a local object in your system.
- Execute the report ZBSP_XSRF_PARAM_ESS_LEAVEREQ and when requested, specify a relevant transport request number. The report will fill the database table BSPTEMPXSRFSTORE with relevant table entries for the BSP applications adapted by this note.
Reason and prerequisites
PT-RC-UI-XS executes certain functions by referencing specific URLs. When an attacker tricks an authenticated user’s browser into making a request containing a certain URL and specific parameters, the function is executed with the rights of the authenticated user. The attacker may use a cross-site scripting attack to do this, or they may present a link to the victim.
References
- Note 1520324 – Advance creation of XSRF information
- Note 693368 – ESS: Error in R/3; Business Server Page Error (Admin)
Full note on SAP: SAP Support Launchpad note 1600530
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].