Unauthorized Use of Application Functions in REST Interface, SAP security note 1806098

SAP security note 1806098, “Unauthorized Use of Application Functions in REST Interface”. Below are the symptom and SAP recommended solution.

Description

Symptom

An attacker can execute functions in the SAP NetWeaver Identity Management 7.2 REST interface with version identifier “v72alpha” without authentication and authorization.

Solution

Security Correction: Prerequisites. A security correction is available to prevent the described attack. This correction utilizes a new protection infrastructure introduced with SAP NetWeaver Application Server Java (AS Java) 7.30 SP09 and AS Java 7.3 EhP 1 SP06. Ensure your AS Java is updated to one of these releases or higher, and deploy the SAP NetWeaver Identity Management User Interface component version containing the security correction.

Security Correction: Availability. Apply the attached patch for SAP NetWeaver Identity Management 7.2 SP07 User Interface. No patch is required for SAP NetWeaver Identity Management 7.2 SP08 and later.

Security Correction: Required Changes to REST Clients. The correction introduces a token-based protection mechanism for modifying requests:

• Retrieve a Token: perform a GET, HEAD, or OPTIONS request with the HTTP header X-CSRF-Token: Fetch. The REST interface generates and returns a token in the X-CSRF-Token response header.
• Use the Token: include the retrieved token in the X-CSRF-Token header for all modifying requests, and ensure all cookies set by the server during the token retrieval are included in modifying requests.

If validation fails, a 403 Forbidden status is returned. Successful validation allows the requested operation to proceed.

Temporary Measures If Immediate Update Is Not Feasible.

• Disable the New Protection Mechanism: if you cannot update all REST clients immediately, you can temporarily disable the new protection mechanism by navigating to SAP NetWeaver Administrator > Configuration > Infrastructure > Java System Properties, filtering for the tc~idm~jmx~rest~app web application, modifying the v72alpha.security.xsrf.disable_token_based_protection property to true, and restarting AS Java. Ensure you apply additional protective measures, such as limiting REST interface access to specific hosts.
• Disable the REST Interface: if the REST interface is not needed, deactivate the idmrest application alias on AS Java to block access.
• Limit Access to Specific Hosts: restrict REST interface access to trusted hosts using firewall or load balancer URL filtering, so that only necessary hosts can communicate with the REST interface to mitigate XSRF risks.

Reason and prerequisites

The SAP NetWeaver Identity Management 7.2 REST interface with version identifier “v72alpha” executes certain functions by referencing specific URLs. When an attacker tricks an authenticated user’s browser into making a request containing a certain URL and specific parameters, the function is executed with the rights of the authenticated user. This vulnerability applies to all modification operations provided by the REST interface. Attackers may use cross-site scripting attacks or present malicious links to the victim.