WebdocsUnauthorized Content Modification & Session Handling, SAP security note 1505976

SAP security note 1505976, “Webdocs: Unauthorized Content Modification & Session Handling”, is a note released on 14.12.2010. Below are the symptom, reason and prerequisites, SAP recommended solution, references and the affected software components.

Description

Symptom

This security note addresses two critical issues:

• Cross Site Scripting (XSS): The HTML files of the BSP Application WebDocuments are vulnerable to XSS. A malicious user can embed HTML into a page that others will open, allowing unauthorized modification of displayed content and potentially stealing authentication information from legitimate users.
• Session handling: WebDocuments lack a logoff feature and proper session management, which might lead to session hijacking.

Solution

Implement the corrections provided with this note. Before applying the corrections, perform the following manual steps to maintain OTR texts:

• Run transaction sotr_edit.
• Create a new alias: Alias CVAW/LOGOFF, Text "Logoff", Length 11, Package CVAW, Language English, Object Type WAPP.
• Maintain translations: add the "Logoff" text in other required languages.
• Save changes.

Recommendation: use the application over HTTPS instead of HTTP to enhance security.

Reason and prerequisites

• XSS vulnerability: Insufficient encoding of input and output parameters in WebDocuments allows reflected XSS attacks. Attackers can steal user authentication information and impersonate users, potentially compromising the application's security fully if an administrator is targeted.
• Session management issues: Absence of logoff functionality and proper session handling makes the application susceptible to session hijacking.

References

• Webdocuments: XSRF Protection for BSP Application WebDocuments
• Unauthorized modification of displayed content in Webdocs

Affected components

• EA-APPL (110, 200, 500, 600, 602, 603, 604, 605)