High priority
SAP security note 1495377, "Unauthorized modification of displayed content in IC apps.", released on 14.12.2010. Below are the symptom and SAP recommended solution.
Description
Symptom
The BSP Applications: CRMCMP_CCS_EML, CRMCMP_CCS_STDR, CRMCMP_CTRANSCR, CRMCMP_CLM and BSP Page: SESSION_BUFFERED_FRAME.HTM can be exploited by a malicious user to modify displayed application content without authorization. This vulnerability may allow attackers to obtain authentication information from other legitimate users.
Solution
Add the page attribute forceEncode="html" to the affected BSP pages to ensure proper encoding of output parameters.
Reason and prerequisites
These BSP Applications and the BSP Page do not sufficiently encode OUTPUT parameters, leading to a reflected cross-site scripting vulnerability. An attacker can use this flaw to temporarily deface or modify website content or steal authentication data, enabling impersonation of users, including administrators, which can fully compromise the application’s security.
Full note on SAP: SAP Support Launchpad note 1495377
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].