SAP security note 1525137, "Unauthorized usage of application functionality in BCV", is a note. Below are the symptom and SAP recommended solution.
Description
Symptom
A malicious user can trigger functionality in Business Context Viewer (BCV) without authentication and authorization.
Solution
- Refer to Note 1481392 for additional information and instructions. The corrections from Note 1481392 are a prerequisite for implementing this note.
- If you have not yet imported Support Package SP05 of Software Component SAP_BS_FND 702, perform the manual correction instructions described below.
- Start transaction SICF (HTTP Service Hierarchy Maintenance).
- On the selection screen, enter the service path /sap/bc/webdynpro/bcv/ and service name WDC_UIF_CHIP, then execute the transaction.
- Choose service WDC_UIF_CHIP by double-clicking on the corresponding entry in the tree and switch to change mode.
- Press the GUI Configuration pushbutton.
- In the dialog box, enter service parameter ~XSRFCHECK with value 1.
- Save the changes.
Reason and prerequisites
BCV executes certain functions by referencing specific URLs. An attacker can trick an authenticated user’s browser into making a request with a specific URL and parameters, causing the function to be executed with the user’s rights. This can be achieved through a Cross-Site Scripting (XSS) attack or by presenting a clickable link to the victim.
Full note on SAP: SAP Support Launchpad note 1525137
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
