SAP security note 1597489, "Unauthorized Use of Application Functions in SCM-EWM-RF". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An attacker can execute functions in SCM-EWM without authentication and authorization.
Solution
Prerequisites:
- SAP Note 1481392 is a prerequisite for implementing this SAP Note.
- SAP Note 1571684 is also required.
Reason and prerequisites
SCM-EWM executes certain functions by referencing specific URLs. When an attacker tricks an authenticated user’s browser into making a request containing a certain URL and specific parameters, the function is executed with the rights of the authenticated user. The attacker may use a cross-site scripting attack to do this, or they may present a link to the victim.
References
- SAP Note 1571684 – Protect against cross-site request forgery for ITSmobile Services
- SAP Note 1481392 – Cross Site Request Forgery Protection for ITS
Affected components
- SCMEWM 510
- SCMEWM 700
- SCMEWM 701
- SCMEWM 702
Full note on SAP: SAP Support Launchpad note 1597489
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].