Unauthorized modification of displayed content, SAP security note 1509342

SAP security note 1509342, "Unauthorized modification of displayed content". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

By manipulating the input data of the Web Channel applications, including E-Commerce B2B, E-Commerce B2C, and E-Service Claims and Returns, a malicious user can modify data of another user without authorization and potentially obtain authentication information from other legitimate users.

Solution

This note contains Java corrections for E-Commerce and CRM Web Channel.

Reason and prerequisites

Due to inadequate output encoding by specific websites of the Web Channel applications, reflected cross-site scripting can be triggered. This vulnerability can be exploited to:

• Non-permanently deface or modify displayed content on a website.
• Steal another user’s authentication information, such as session data.
• Impersonate users, gaining access to information with the same rights as the target user.
• Potentially achieve full compromise of the application’s security if an administrator is impersonated.

References

• SAP Note 1777016 – Additional XSRF Protection switch in the XCM
• SAP Note 1603081 – Unauthorized modification of displayed content in ISA-AUC
• SAP Note 1601155 – Unauthorized modification of displayed content in CRM-ISA
• SAP Note 1548767 – Unauthorized use of functions in CRM Web Channel
• SAP Note 1501646 – Unauthorized use of functions in CRM Web Channel
• SAP Note 1315240 – Possible XSS vulnerability in theme functionality of WebChan

Affected components

• SAP-SHRWEB
  • crm/isa/web/b2b – confirm.jsp, organizer-content-doc-search.jsp, organizer-customer-doc-search.jsp, summarybasket2.jsp, showpredecessorquotations.jsp, showpredecessors.jsp
  • crm/isa/web/b2c – orderList.inc.jsp
  • crm/tc/web/catalog – ProductDetails.inc.jsp, productlist.block.inc.jsp, productlist.list.inc.jsp
  • crm/eservice/web/cr_b2b – return_entry_main.jsp, return_status_main.jsp