Unauthorized use of functions in CRM Web Channel, SAP security note 1548767

SAP security note 1548767, "Unauthorized use of functions in CRM Web Channel". Below are the symptom and SAP recommended solution.

Description

Symptom

A malicious user can execute functions from Web Channel applications without authentication and authorization.

Solution

CRM Web Channel applications now provide XSRF/CSRF protection.

Settings. The XSRF/CSRF protection of Web Channel applications is based on the Java XSRF API of SAP NetWeaver. Therefore, the protection must be activated on the SAP Application Server Java (J2EE) that is used. To do this, set the parameter xsrf.protection.enabled in the Web Container Service to "true". See SAP Note 1450166 for more information.

The XSRF/CSRF protection of Web Channel applications is deactivated in the standard system. You can activate or deactivate the protection by using the parameter enableXSRFProtection in Extended Configuration Management (XCM) (application_security -> application_security_config).

Additional configuration for B2B applications. For a Business-to-Business (B2B) application in SAP CRM E-Commerce, the parameter isXsrfPortalScenario in Extended Configuration Management (XCM) must also be set to "true" if one of the Web Channel applications is integrated into the SAP NetWeaver Portal. To do this, go to the "scenario_security" component of your XCM application configuration and set the parameter to "true".

Reason and prerequisites

Web Channel applications execute certain functions by calling HTTP requests with parameters. When a malicious user tricks an authenticated user's browser into making certain requests, the malicious user can call functions in Web Channel applications with the rights of the authenticated user. The malicious user may exploit a cross-site scripting vulnerability to do this, or they may send a special link to the user, in an e-mail, for example.

References

• SAP Note 1777016 – Additional XSRF Protection switch in the XCM
• SAP Note 1539472 – Incorrect error messages due to Note 1501646
• SAP Note 1509342 – Unauthorized modification of displayed content
• SAP Note 1503236 – Application configuration due to J2EE security settings
• SAP Note 1501646 – Unauthorized use of functions in CRM Web Channel
• SAP Note 1450166 – Unauthorized usage of application functionality