Unauthorized modification of stored content in SXSL_DEMO, SAP security note 1458924

SAP security note 1458924, "Unauthorized modification of stored content in SXSL_DEMO", is a program error note released on August 10, 2010. Below are the symptom and SAP recommended solution.

Description

Symptom

The SXSLT_DEMO and SXLST_TRAINING packages could be abused by a malicious user, who could modify the demo content, persist the modified content without authorization, and potentially obtain authentication information from other legitimate users.

Solution

Apply the support package provided in this SAP note. Individual corrective instructions are not provided due to their complexity. However, you may choose to remove the complete packages SXSLT_DEMO and SXSLT_TRAINING from your system by modification.

Reason and prerequisites

The SXSL_DEMO and SXSLT_TRAINING packages contain outdated demo content related to the ABAP XSLT processor. This includes BSP applications that read information from URL parameters. The content was delivered as part of the software component BC-ABA-XML. It is no longer up to date, and its removal will not affect productive software components.

Stored cross-site scripting can be used to permanently modify displayed content from a website, allowing the malicious user to embed content that is rendered automatically without needing to individually target victims. Additionally, stored cross-site scripting can be used to steal another user’s authentication information, such as data relating to their current session. An attacker who gains access to this data could impersonate the user and access all information with the same rights as the target user. If an administrator is impersonated, the application’s security could be fully compromised.