SAP security note 1637050, “Unauthorized use of application functions in WS-Browser”. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An attacker can execute functions in WebServices-Browser without authentication and authorization.
Solution
- Refer to Note 1520324 for additional information and instructions. The corrections from this note are prerequisites.
- Implement the correction instructions in this note. Create the report ZBSP_XSRF_PARAM_SRT_BROWSER as a local object in your system.
- Execute the report ZBSP_XSRF_PARAM_SRT_BROWSER and provide a relevant transport request number when prompted. This report populates the BSPTEMPXSRFSTORE database table with the necessary entries for the adapted BSP applications.
Reason and prerequisites
The WebServices-Browser (BSP ‘WebServiceBrowser’ / BSP ‘SRT_BROWSER’) executes certain functions by referencing specific URLs. If an attacker tricks an authenticated user’s browser into making a request with certain URLs and parameters, the function executes with the user’s permissions. This could be achieved via cross-site scripting (XSS) or by presenting a malicious link to the victim.
References
Affected components
- SAP_BASIS versions 620 to 730
Full note on SAP: SAP Support Launchpad note 1637050
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
