Unauthorized modification of stored content in IC_BASE, SAP security note 1455121

SAP security note 1455121, "Unauthorized modification of stored content in IC_BASE". Below are the symptom and SAP recommended solution.

Description

Symptom

The BSP application IC_BASE (Pages with Flow Logic: main.htm) can be exploited by a malicious user to modify application content, persist the modified content without authorization, and potentially obtain authentication information from other legitimate users.

Solution

Implement the correction instructions provided in SAP Security Note 1455121.

Reason and prerequisites

Applications based on the BSP application IC_BASE result in a stored cross-site scripting issue. Stored XSS can be used to permanently modify displayed content on a website, allowing malicious users to embed content that is rendered automatically without needing to target victims individually. Additionally, stored XSS can be used to steal another user’s authentication information, such as data related to their current session. An attacker with access to this data could impersonate the user and access all information with the same rights as the target user. If an administrator is impersonated, the application security could be fully compromised.