SAP security note 1525156, "Unauthorized modification of displayed content in WebDynpro", is a note. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
WebDynpro application could be abused by a malicious user, who could modify displayed application content without authorization and potentially obtain authentication information from other legitimate users.
Solution
The issue will be fixed by a WebDynpro for Java patch.
- Installation Steps:
- SP Patch Level: refer to the “SP Patch Level” section to identify which patches contain the necessary corrections.
- Apply Patches: install the specified patch or a newer one, as WD-RUNTIME and FRAMEWORK patches are always cumulative.
- Downloading Patches:
- All WebDynpro for Java patches are available on SAP Service Marketplace.
- Refer to Note 330793 for instructions on downloading patches.
- Refer to Note 1395865 for information on finding WebDynpro for Java related SCAs.
- System Update via JSPM: refer to the official JSPM documentation for guidance.
- Release Specific Instructions:
- NW04 / NW 6.40: patches are provided as SAR files. Extract them to obtain SDAs, which can then be deployed using JSPM.
- NW 7.00 to NW 7.20: patches are provided as SCAs and should be deployed directly using JSPM.
- Recommendation: it is recommended to apply both WD-RUNTIME.SCA and FRAMEWORK.SCA patches. If a particular archive is not listed in the ‘SP Patch Level’ tab, apply the corresponding patch available on the SAP Service Marketplace.
Reason and prerequisites
The WebDynpro Framework does not sufficiently encode input parameters, resulting in a reflected cross-site scripting (XSS) vulnerability. This can be exploited to non-permanently deface or modify displayed content from a website. Attackers can steal users’ authentication information, potentially allowing them to impersonate users and access information with the same privileges. If an administrator is impersonated, the application’s security could be fully compromised.
Affected components
- SAP-JEE
- SAP_JTECHS
- SAP_JTECHF
- WD-RUNTIME
Full note on SAP: SAP Support Launchpad note 1525156
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].