SAP security note 1511782, "Unauthorized usage of functionality in Signature Service", is a note. Below are the symptom and the SAP recommended solution.
Description
Symptom
A malicious user can trigger functionality in the Signature Service of SAP Billing Consolidation 2.0 SP4 AH without authentication and authorization.
Solution
XSRF attacks must be addressed within web applications. These applications should ensure that for state-changing operations, they do not rely solely on credentials or tokens that are automatically submitted by browsers. A common approach is to include a special token in each request, associated with the user session and valid only for the session’s lifetime.
The SAP NetWeaver Application Server Java (AS Java) has been enhanced with the XSRF Protection Framework. You can secure your web application using the token-based approach by adopting this framework. This note contains the steps to adopt the XSRF Protection Framework for the Signature Service of SAP Billing Consolidation 2.0.
SAP’s XSRF Protection Framework is available for specific versions of SAP NetWeaver. Please refer to Note 1450166 for details regarding availability. To enable XSRF protection for the Signature Service of SAP Billing Consolidation 2.0, apply the aforementioned note before following the steps outlined in this note. Additionally, refer to the SAP XSRF Protection Guide attached to Note 1450166 to understand the XSRF protection procedure comprehensively.
After reviewing the documentation, proceed with the detailed steps specific to the Signature Service of SAP Billing Consolidation 2.0.
The solution is implemented in the Signature Service of SAP Billing Consolidation 2.0 SP4 AK or later. Download the relevant support package for your release from the SAP Service Marketplace and deploy it on your AS Java.
Additionally, you need to implement NetWeaver patches, detailed in Note 1450166. These NetWeaver patches are prerequisites for implementing the Signature Service of SAP Billing Consolidation 2.0 support packages.
Reason and prerequisites
The Signature Service of SAP Billing Consolidation 2.0 SP4 AH executes certain functions by referencing specific URLs. When an attacker tricks an authenticated user’s browser into making a request containing a particular URL and specific parameters, the function is executed with the user’s rights.
If present, the attacker may use a Cross Site Scripting (XSS) attack to trigger the exploit or present a clickable link to the victim.
Full note on SAP: SAP Support Launchpad note 1511782
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
