SAP security note 1536474, "SAP ME MFG 5.2 is vulnerable to XSRF attacks." Below are the symptom, reason and prerequisites and SAP recommended solution.
Description
Symptom
An unauthorized user can trigger functionality in SAP ME MFG 5.2 on behalf of an unsuspecting authorized user by fooling the unsuspecting user into triggering a URL callback via a script or special HTML element parameter.
Solution
XSRF attacks must be addressed within web applications. These applications must ensure that for state-changing operations they are not solely relying on credentials or tokens that are automatically submitted by browsers. A common approach is to include a special token in each request, which is associated with the user session and is valid only for the session lifetime.
To correct this issue, please apply the supplied security patch 5.2.5.1.
Reason and prerequisites
SAP ME MFG 5.2 executes state-changing functionality via referencing URLs. In certain scenarios, it is possible for an unauthorized and unauthenticated third party to trigger this functionality on behalf of an authorized authenticated user without the latter’s knowledge and/or consent.
Full note on SAP: SAP Support Launchpad note 1536474
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
