Skip links
RedRays - Your SAP Security Solution
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

SAP Security on Udemy

Unauthorized use of functions in CRM Web Channel, SAP security note 1501646

SAP Note 1501646
High priority

SAP security note 1501646, "Unauthorized use of functions in CRM Web Channel", is a program error note released on April 18, 2011. Below are the symptom, SAP recommended solution and the affected software components.

ComponentCustomer Relationship Management > Internet Sales (CRM-ISA)
CategoryProgram Error
PriorityCorrection with High Priority
StatusReleased for Customer
Released onApril 18, 2011

Description

Symptom

A malicious user can execute functions from Web Channel applications without proper authentication and authorization.

Solution

CRM Web Channel applications now include protection against XSRF/CSRF attacks.

For SAP CRM 7.01 Support Package 3 and later: XSRF/CSRF protection is enabled by default as part of the standard system. For older releases: apply the necessary Support Package patches listed in this note to enable XSRF/CSRF protection.

Configuration steps:

  • Enable XSRF/CSRF Protection: set the parameter xsrf.protection.enabled to true in the Web Container Service on the SAP Application Server Java (J2EE) being used. Refer to SAP Note 1450166 for detailed instructions.
  • Additional Settings for B2B Applications: if integrating Web Channel applications with the SAP NetWeaver Portal, ensure the parameter isXsrfPortalScenario is set to true in Extended Configuration Management (XCM) within the scenario_security component of your XCM application configuration.

Reason and prerequisites

Web Channel applications execute certain functions by making HTTP requests with specific parameters. If a malicious user tricks an authenticated user’s browser into making these requests, they can execute functions with the user’s permissions. This can be exploited through cross-site scripting (XSS) vulnerabilities or by sending specially crafted links to users via email or other means.

References

  • SAP Note 1575499 – Update #1 to Security Note 1501646
  • SAP Note 1818241 – Cumulative Fix to Various Web Channel XSRF Related Issues
  • SAP Note 1626809 – XSRF Protection for Customer Enhancements of CRM Web Channel

Affected components

  • SAP-CRMJAV: 5.0, 5.2, 6.0, 700, 701
  • SAP-CRMWEB: 5.0, 5.2, 6.0, 700, 701
  • SAP-SHRWEB: 5.0, 5.2, 6.0, 700, 701
  • SAP-SHRJAV: 5.0, 5.2, 6.0, 700, 701
  • SAP-CRMAPP: 5.0, 5.2, 6.0, 700, 701
  • SAP-SHRAPP: 5.0, 5.2, 6.0, 7.0, 700, 701

Full note on SAP: SAP Support Launchpad note 1501646

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#CRM-ISA #XSRF #CSRF #Web Channel

Explore More