Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1682810-3)
SAP Support Packages
(SAPK-10002INSRMSMC, SAPK-10003INSRMSMC, SAPK-10004INSRMSMC)
Описание
SLC-REG executes certain functions by referencing specific URLs. When an attacker tricks an authenticated user's browser into making a request containing a certain URL and specific parameters, the function is executed with the rights of the authenticated user. The attacker may use a cross-site scripting attack to do this, or they may present a link to the victim.
Как исправить
Implement the following correction instructions manually or import the relevant Support Package.
------------------------------------------------------------------------
|Manual Activity |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SRMSMC |
| Release 100 SAPK-10002INSRMSMC - SAPK-10002INSRMSMC |
------------------------------------------------------------------------
1. Adapt SICF settings of service "ROS_EXT_2":
logon to the development client of your SLC system
go to transaction SICF
enter "ROS_EXT_2" in field "Service Name" and press "Execute"
in the details of service "ROS_EXT_2", navigate to tab "Service Data"
enter the value "SLCBSPR2" in field "SAP Authoriz."
save the changed SICF service "ROS_EXT_2"
test the service "ROS_EXT_2" by right-clicking on it and selecting "Test Service"
transport the adapted SICF service "ROS_EXT_2" through your system landscape
2. Adapt PFCG role for initial Supplier user
logon to the customizing client of your SLC system
go to transaction PFCG
enter role "/SRMSMC/SUPPLIER_INITIAL" and press "Change"
navigate to tab "Authorizations"
press button "Change Authorization Data"
press button "Manual entry of authorization objects"
enter authorization object "S_ICF" and press button "Continue (Enter)"
enter the following attributes for authorization object "S_ICF":
ICF_FIELD = "SERVICE"
ICF_VALUE = "SLCBSPR2"
press button "Save"
press button "Generate"
press button "Back (F3)"
press button "Save" to save the PFCG role "/SRMSMC/SUPPLIER_INITIAL"
transport the adapted PFCG role "/SRMSMC/SUPPLIER_INITIAL" through your system landscape
remark: the PFCG role "/SRMSMC/SUPPLIER_INITIAL" is delivered by SAP as the role for the initial Supplier user. If you have changed this setting and set a different role as the role for the initial Supplier user, you certainly have to adapt the corresponding PFCG role. You can use the function module "/SRMSMC/EXT_ROLE_GET_TAD_ROLES" to get the PFCG roles which are assigned to the initial Supplier user.
3. Adapt PFCG roles for the "Supplier Data Maintenance"
adapt the following PFCG roles as decribed in step 2:
"/SRMSMC/EMPLOYEE_ADMINISTRATOR"
"/SRMSMC/QUALIFICATION_EXPERT"
"/SRMSMC/SUPPLIER_MASTER_DATA"
remark: these three PFCG roles are delivered by SAP as roles for the "Supplier Data Maintenance" (BSP application "/SRMSMC/S3Q_EXT") on the Sell side (these roles are assigned to the administrator user in the second step of the registration process). If you have changed this setting, you certainly have to adapt different PFCG roles. You can use the function module "/SRMSMC/EXT_ROLE_GET_ADM_ROLES" to get the PFCG roles which are assigned to the administrator user.
------------------------------------------------------------------------
|Manual Activity |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SRMSMC |
| Release 100 Until SAPK-10001INSRMSMC |
------------------------------------------------------------------------
1. Create the new BSP application "/SRMSMC/ROS_EXT_2":
logon to the development client of your SLC system
go to transaction SE80
open BSP application "/SRMSMC/ROS_EXT"
right-click on the BSP application and select "Copy..."
enter "/SRMSMC/ROS_EXT_2" as target application, select "Pages" and "Mime Objects" and click on "Enter"
enter package "/SRMSMC/ROS_EXT_UI" and press "Save"
enter the following text as "Short Description" of the BSP application: "Supplier Registration - part 2: Admin account creation"
in tab "Properties", enter in the field "Initial BSP" the value: "ROS_BSP_SECOND.do"
delete the controller "BSPWDApplication.do" and the following views:
"Reg_confirmation.inc"
"Reg_confirmation_fail.inc"
"ROS_BSP_START.inc"
navigate to tab "Properties" of the BSP application "/SRMSMC/ROS_EXT_2" and select the checkbox "XSRF Protection"
in the controller "ROS_BSP_SECOND.do", select the checkbox "Start BSP"
finally activate all objects of the BSP application "/SRMSMC/ROS_EXT_2"
2. Adapt SICF settings of service "ROS_EXT_2":
logon to the development client of your SLC system
go to transaction SICF
enter "ROS_EXT_2" in field "Service Name" and press "Execute"
in the details of service "ROS_EXT_2", navigate to tab "Service Data"
enter the value "SLCBSPR2" in field "SAP Authoriz."
navigate to tab "Error Pages" of service "ROS_EXT_2"
navigate to tab "Logon Errors" (on level below tab "Error Pages")
select radio button "System Logon" and press "Configuration"
in "Settings Selection", select button "Define Service-Specific Settings"
in "Select Display", select the checkboxes "Language" and "System Messages"
in "Actions During Logon", select only the two checkboxes "Do Not Display Warnings" and "Support Accessibility" (do not select the checkbox "Login-XSRF Schutz ausschalten")
in "Logon Layout and Procedure", click the radio button "SAP Implementation" and choose "Signature Design" as Template and "SAP Tradeshow" as SAP Theme
press "Input (Enter)"
save the changed SICF service "ROS_EXT_2"
test the service "ROS_EXT_2" by right-clicking on it and selecting "Test Service"
transport the newly created BSP application "/SRMSMC/ROS_EXT_2" together with the SICF service "ROS_EXT_2" through your system landscape
3. Adapt PFCG role for initial Supplier user
logon to the customizing client of your SLC system
go to transaction PFCG
enter role "/SRMSMC/SUPPLIER_INITIAL" and press "Change"
navigate to tab "Authorizations"
press button "Change Authorization Data"
press button "Manual entry of authorization objects"
enter authorization object "S_ICF" and press button "Continue (Enter)"
enter the following attributes for authorization object "S_ICF":
ICF_FIELD = "SERVICE"
ICF_VALUE = "SLCBSPR2"
press button "Save"
press button "Generate"
press button "Back (F3)"
press button "Save" to save the PFCG role "/SRMSMC/SUPPLIER_INITIAL"
transport the adapted PFCG role "/SRMSMC/SUPPLIER_INITIAL" through your system landscape
remark: the PFCG role "/SRMSMC/SUPPLIER_INITIAL" is delivered by SAP as the role for the initial Supplier user. If you have changed this setting and set a different role as the role for the initial Supplier user, you certainly have to adapt the corresponding PFCG role. You can use the function module "/SRMSMC/EXT_ROLE_GET_TAD_ROLES" to get the PFCG roles which are assigned to the initial Supplier user.
4. Adapt PFCG roles for the "Supplier Data Maintenance"
adapt the following PFCG roles as decribed in step 3:
"/SRMSMC/EMPLOYEE_ADMINISTRATOR"
"/SRMSMC/QUALIFICATION_EXPERT"
"/SRMSMC/SUPPLIER_MASTER_DATA"
remark: these three PFCG roles are delivered by SAP as roles for the "Supplier Data Maintenance" (BSP application "/SRMSMC/S3Q_EXT") on the Sell side (these roles are assigned to the administrator user in the second step of the registration process). If you have changed this setting, you certainly have to adapt different PFCG roles. You can use the function module "/SRMSMC/EXT_ROLE_GET_ADM_ROLES" to get the PFCG roles which are assigned to the administrator user.
5. Adapt customizing for Registration process:
logon to your SLC Sell side system where the Registration process is carried out
check in transaction SICF if the serice "ROS_EXT_2" is active (if not then activate the serivce)
go to transaction SE80
open the BSP application "/SRMSMC/ROS_EXT_2"
double-click on controller "ROS_BSP_SECOND.do"
copy the URL which is displayed in field "URL"
start transaction SPRO
click on button "Display SAP Reference IMG"
navigate to path:
-> SAP Implementation Guide
-> SAP Supplier Lifecycle Management
-> Supplier Registration (Sell Side)
-> Maintain Customer Settings for Supplier Registration
in the field "REG_LOGIN_URL" enter the copied URL of controller "ROS_BSP_SECOND.do" with the addition "?sap-client=XXX" where "XXX" is the client of the Sell side system
press "Save"
------------------------------------------------------------------------
|Manual Activity |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SRMSMC |
| Release 100 SAPK-10002INSRMSMC - SAPK-10002INSRMSMC |
------------------------------------------------------------------------
1. Adapt SICF settings of service "ROS_EXT_2":
logon to the development client of your SLC system
go to transaction SICF
enter "ROS_EXT_2" in field "Service Name" and press "Execute"
in the details of service "ROS_EXT_2", navigate to tab "Service Data"
enter the value "SLCBSPR2" in field "SAP Authoriz."
save the changed SICF service "ROS_EXT_2"
test the service "ROS_EXT_2" by right-clicking on it and selecting "Test Service"
transport the adapted SICF service "ROS_EXT_2" through your system landscape
2. Adapt PFCG role for initial Supplier user
logon to the customizing client of your SLC system
go to transaction PFCG
enter role "/SRMSMC/SUPPLIER_INITIAL" and press "Change"
navigate to tab "Authorizations"
press button "Change Authorization Data"
press button "Manual entry of authorization objects"
enter authorization object "S_ICF" and press button "Continue (Enter)"
enter the following attributes for authorization object "S_ICF":
ICF_FIELD = "SERVICE"
ICF_VALUE = "SLCBSPR2"
press button "Save"
press button "Generate"
press button "Back (F3)"
press button "Save" to save the PFCG role "/SRMSMC/SUPPLIER_INITIAL"
transport the adapted PFCG role "/SRMSMC/SUPPLIER_INITIAL" through your system landscape
remark: the PFCG role "/SRMSMC/SUPPLIER_INITIAL" is delivered by SAP as the role for the initial Supplier user. If you have changed this setting and set a different role as the role for the initial Supplier user, you certainly have to adapt the corresponding PFCG role. You can use the function module "/SRMSMC/EXT_ROLE_GET_TAD_ROLES" to get the PFCG roles which are assigned to the initial Supplier user.
3. Adapt PFCG roles for the "Supplier Data Maintenance"
adapt the following PFCG roles as decribed in step 2:
"/SRMSMC/EMPLOYEE_ADMINISTRATOR"
"/SRMSMC/QUALIFICATION_EXPERT"
"/SRMSMC/SUPPLIER_MASTER_DATA"
remark: these three PFCG roles are delivered by SAP as roles for the "Supplier Data Maintenance" (BSP application "/SRMSMC/S3Q_EXT") on the Sell side (these roles are assigned to the administrator user in the second step of the registration process). If you have changed this setting, you certainly have to adapt different PFCG roles. You can use the function module "/SRMSMC/EXT_ROLE_GET_ADM_ROLES" to get the PFCG roles which are assigned to the administrator user.
------------------------------------------------------------------------
|Manual Activity |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SRMSMC |
| Release 100 Until SAPK-10001INSRMSMC |
------------------------------------------------------------------------
1. Create the new BSP application "/SRMSMC/ROS_EXT_2":
logon to the development client of your SLC system
go to transaction SE80
open BSP application "/SRMSMC/ROS_EXT"
right-click on the BSP application and select "Copy..."
enter "/SRMSMC/ROS_EXT_2" as target application, select "Pages" and "Mime Objects" and click on "Enter"
enter package "/SRMSMC/ROS_EXT_UI" and press "Save"
enter the following text as "Short Description" of the BSP application: "Supplier Registration - part 2: Admin account creation"
in tab "Properties", enter in the field "Initial BSP" the value: "ROS_BSP_SECOND.do"
delete the controller "BSPWDApplication.do" and the following views:
"Reg_confirmation.inc"
"Reg_confirmation_fail.inc"
"ROS_BSP_START.inc"
navigate to tab "Properties" of the BSP application "/SRMSMC/ROS_EXT_2" and select the checkbox "XSRF Protection"
in the controller "ROS_BSP_SECOND.do", select the checkbox "Start BSP"
finally activate all objects of the BSP application "/SRMSMC/ROS_EXT_2"
2. Adapt SICF settings of service "ROS_EXT_2":
logon to the development client of your SLC system
go to transaction SICF
enter "ROS_EXT_2" in field "Service Name" and press "Execute"
in the details of service "ROS_EXT_2", navigate to tab "Service Data"
enter the value "SLCBSPR2" in field "SAP Authoriz."
navigate to tab "Error Pages" of service "ROS_EXT_2"
navigate to tab "Logon Errors" (on level below tab "Error Pages")
select radio button "System Logon" and press "Configuration"
in "Settings Selection", select button "Define Service-Specific Settings"
in "Select Display", select the checkboxes "Language" and "System Messages"
in "Actions During Logon", select only the two checkboxes "Do Not Display Warnings" and "Support Accessibility" (do not select the checkbox "Login-XSRF Schutz ausschalten")
in "Logon Layout and Procedure", click the radio button "SAP Implementation" and choose "Signature Design" as Template and "SAP Tradeshow" as SAP Theme
press "Input (Enter)"
save the changed SICF service "ROS_EXT_2"
test the service "ROS_EXT_2" by right-clicking on it and selecting "Test Service"
transport the newly created BSP application "/SRMSMC/ROS_EXT_2" together with the SICF service "ROS_EXT_2" through your system landscape
3. Adapt PFCG role for initial Supplier user
logon to the customizing client of your SLC system
go to transaction PFCG
enter role "/SRMSMC/SUPPLIER_INITIAL" and press "Change"
navigate to tab "Authorizations"
press button "Change Authorization Data"
press button "Manual entry of authorization objects"
enter authorization object "S_ICF" and press button "Continue (Enter)"
enter the following attributes for authorization object "S_ICF":
ICF_FIELD = "SERVICE"
ICF_VALUE = "SLCBSPR2"
press button "Save"
press button "Generate"
press button "Back (F3)"
press button "Save" to save the PFCG role "/SRMSMC/SUPPLIER_INITIAL"
transport the adapted PFCG role "/SRMSMC/SUPPLIER_INITIAL" through your system landscape
remark: the PFCG role "/SRMSMC/SUPPLIER_INITIAL" is delivered by SAP as the role for the initial Supplier user. If you have changed this setting and set a different role as the role for the initial Supplier user, you certainly have to adapt the corresponding PFCG role. You can use the function module "/SRMSMC/EXT_ROLE_GET_TAD_ROLES" to get the PFCG roles which are assigned to the initial Supplier user.
4. Adapt PFCG roles for the "Supplier Data Maintenance"
adapt the following PFCG roles as decribed in step 3:
"/SRMSMC/EMPLOYEE_ADMINISTRATOR"
"/SRMSMC/QUALIFICATION_EXPERT"
"/SRMSMC/SUPPLIER_MASTER_DATA"
remark: these three PFCG roles are delivered by SAP as roles for the "Supplier Data Maintenance" (BSP application "/SRMSMC/S3Q_EXT") on the Sell side (these roles are assigned to the administrator user in the second step of the registration process). If you have changed this setting, you certainly have to adapt different PFCG roles. You can use the function module "/SRMSMC/EXT_ROLE_GET_ADM_ROLES" to get the PFCG roles which are assigned to the administrator user.
5. Adapt customizing for Registration process:
logon to your SLC Sell side system where the Registration process is carried out
check in transaction SICF if the serice "ROS_EXT_2" is active (if not then activate the serivce)
go to transaction SE80
open the BSP application "/SRMSMC/ROS_EXT_2"
double-click on controller "ROS_BSP_SECOND.do"
copy the URL which is displayed in field "URL"
start transaction SPRO
click on button "Display SAP Reference IMG"
navigate to path:
-> SAP Implementation Guide
-> SAP Supplier Lifecycle Management
-> Supplier Registration (Sell Side)
-> Maintain Customer Settings for Supplier Registration
in the field "REG_LOGIN_URL" enter the copied URL of controller "ROS_BSP_SECOND.do" with the addition "?sap-client=XXX" where "XXX" is the client of the Sell side system
press "Save"
Ссылки
