SAP security note 1629479, “Unauthorized Use of Application Functions in BSP Application”, is a note released on November 8, 2011. Below are the symptom and SAP recommended solution.
Description
Symptom
A malicious user can execute functions in BSP applications without authentication and authorization.
Solution
Apply the mentioned support package or implement the correction via SAP Note Assistant.
Reason and prerequisites
BSP applications ITMVC2 and JSD_TEST execute certain functions by referencing specific URLs. When a malicious user tricks an authenticated user’s browser into making a request containing a specific URL and parameters, the function executes with the authenticated user’s rights. This can be achieved through a cross-site scripting attack or by presenting a crafted link to the victim.
Full note on SAP: SAP Support Launchpad note 1629479
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].