SAP security note 1638161, "Unauthorized use of application functions in XMLForms". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An attacker can execute functions in XMLForms without authentication and authorization.
Solution
Deploy the patch containing the XSRF Protection Framework as explained in SAP Note No. 1450166, then deploy the latest patch level of the SCAs described in the Validity section of the current note.
Reason and prerequisites
XMLForms executes certain functions by referencing specific URLs. When an attacker tricks an authenticated user’s browser into making a request containing a certain URL and specific parameters, the function is executed with the rights of the authenticated user. The attacker may use a cross-site scripting attack to do this, or they may present a link to the victim.
References
- 1670979 – KMC in SAP NetWeaver 7.0 SPS26
- 1581513 – KMC in EHP2 for SAP NetWeaver 7.02 SPS9
- 1514806 – KMC in EHP2 for SAP NetWeaver 7.02 SPS7
- 1473461 – KMC in EHP1 for SAP NetWeaver 7.0 SPS8
- 1450166 – Unauthorized usage of application functionality
- 1678324 – Cannot save XMLForms documents after filling missing data in
Affected components
- Enterprise Portal > Enterprise Portal – Knowledge Management and Collaboration > Content Management > News (EP-KM-CM-NWS)
Full note on SAP: SAP Support Launchpad note 1638161
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
