Wiki application is vulnerable to CSRF attack, SAP security note 1641153

SAP security note 1641153, "Wiki application is vulnerable to CSRF attack", is a program error note released on 14.02.2012. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

An attacker can execute functions in the wiki application without authentication and authorization.

Solution

A.) For more information about the affected releases, see the "SP Patch Level" tab page of this SAP note. For more information about the SP Stack schedule and updates, visit the SP Stacks maintenance schedule.

B.) Possible workaround before the release of mentioned deliveries: There is no workaround possible.

Reason and prerequisites

The wiki application executes certain functions by referencing specific URLs. When an attacker tricks an authenticated user’s browser into making a request containing a certain URL and specific parameters, the function is executed using the rights of the authenticated user. The attacker might use a cross-site scripting attack to do this, or they might present a link to the victim.

• The patch from SAP Note 1450166 must be implemented in the system.

References

• 1656762 – Not possible to edit a system property in wiki application
• 1655516 – KMC release SAP NetWeaver 7.30 SP7 Add-ons
• 1619655 – KMC for EHP1 Netweaver release 7.31 SP2 – Add-ons
• 1450166 – Unauthorized usage of application functionality
• 1716772 – Direct links do not work for users with initial password
• 1688002 – ISO-8859-1 encoded instead of UTF-8
• 1703280 – Cannot access a wiki page using a direct link

Affected components

• KMC-WIKI 7.30 to 7.30
• KMC-WIKI 7.31 to 7.31