High priority
SAP security note 1544240, "Unauthorized use of application functions in SAP NW Portal", is a note released on April 12, 2011. Below are the symptom and the SAP recommended solution.
Description
Symptom
A malicious user can exploit this vulnerability by tricking an authenticated user’s browser into making specific requests containing certain URLs and parameters, thereby executing functions with the user’s rights. This type of attack can be carried out via cross-site request forgery (XSRF/CSRF) or through cross-site scripting (XSS) to present malicious links to victims.
Self-developed Portal applications lack XSRF protection by default.
Solution
- Implement XSRF Protection: Utilize the XSRF Protection Framework provided by the Java engine to add protection to portal applications. Detailed instructions can be found in SAP Note #1450166.
- Ensure Correct Version: Verify that your system has the version containing the XSRF Protection Framework installed.
CVSS
Score 0
References
- SAP Note #1450166 – Unauthorized usage of application functionality (Component: BC-JAS-WEB)
Full note on SAP: SAP Support Launchpad note 1544240
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].