NWBC Security Problems, SAP security note 1497909

SAP security note 1497909, "NWBC: Security Problems", is released on 09.11.2010. Below are the symptom and SAP recommended solution.

Description

Symptom

This security note is only relevant if you are using the NetWeaver Business Client for HTML. See for availability note 1368177.

1. The NetWeaver Business Client (NWBC) for HTML could be abused by a malicious user, who could modify displayed application content without authorization and potentially obtain authentication information from other legitimate users.

2. The NWBC for HTML can be used to aid in phishing attacks by allowing a malicious user to publish a URL purporting to be from the product, only to redirect the user to an URL of their own choosing. This can enable a malicious user to falsely gain the trust of a victim to elicit private data from that user, such as authentication information.

3. A malicious user can trigger functionality within the NetWeaver Business Client without authentication and authorization.

Solution

Implement this Note 1497909. For more details and other available translations, visit the SAP Notes page.

Reason and prerequisites

1. Pages within the NWBC for HTML do not sufficiently encode input parameters, resulting in a reflected cross-site scripting issue. A reflected cross-site scripting attack can be used to non-permanently deface or modify displayed content from a web site. Reflected cross-site scripting can be used to steal another user’s authentication information, such as data relating to their current session. An attacker who gains access to this data could use it to impersonate the user and access all information with the same rights as the target user. If an administrator is impersonated, the application’s security could be fully compromised.

2. Some pages within the NWBC for HTML enable a cross-domain redirection to occur. A malicious user can include a URL from a different domain to the target application into a URL, which can then be sent to users of the target application. The user believes the content to be delivered from the target application. However, when such a page is visited, content is delivered from the domain of the malicious user’s own choosing. The malicious user can then mimic pages from the target application, such as a log-in page, to get the victim to disclose information they otherwise would not reveal to the user, such as their password.

3. NetWeaver Business Client executes certain functions through referencing specific URLs. When an attacker tricks an authenticated user’s browser into making a request containing a certain URL and specific parameters, the function is executed with the rights of the user. If present, the attacker may use a Cross Site Scripting attack to trigger the exploit, or use an approach in which a link to click is presented to the victim.