SAP security note 887168, “XSS Protection in BSP Page Directives”, is released on 08.10.2009. Below are the symptom and SAP recommended solution.
Description
This security note addresses Cross-Site Scripting (XSS) vulnerabilities in SAP BSP (Business Server Pages) applications. XSS attacks can occur when user input is not properly validated and is directly rendered in the HTTP response, allowing malicious scripts to execute in the user’s browser.
Symptom
Vulnerable code may look like this:
<%@page language="abap"%>
<html><body><form>
<% data: x type string.
x = request->get_form_field( 'x' ).
%>
<input type=text name=x value="<%=x%>">
<input type=submit>
</form></body></html>
In this example, input from the HTTP request is used directly in the response without validation, enabling potential XSS attacks.
Solution
To mitigate XSS vulnerabilities, it is essential to HTML encode all strings before rendering them. There are two primary approaches:
- Manual Encoding: Developers can manually HTML encode user inputs:
<% data: x type string. x = request->get_form_field( 'x' ). x = cl_http_utility=>html_encode( x ). %> <input type=text name=x value="<%=x%>">
- Automated Encoding with Page Attribute: Enhance application security by adding the
forceEncodeattribute in the BSP page directive. This ensures all print statements are automatically HTML encoded:<%@page language="abap" forceEncode="html"%> <html><body><form> <% data: x type string. x = request->get_form_field( 'x' ). %> <input type=text name=x value="<%=x%>"> <input type=submit> </form></body></html>The
forceEncodeattribute can be set tohtml,url, orjavascript, depending on the encoding required.
Important: Do not confuse the print statement encoding with BSP element attribute encoding. For BSP elements, encoding should be handled within the element’s domain.
References
- SAP Note 944279 – BSP Page Directive <%@page forceEncodeOtr="html"%> and <OTR>
- SAP Note 891232 – BSP Security Relevant Changes
- SAP Note 822881 – XSS Support for BSP-Extensions HTMLB, XHTMLB and PHTMLB
- SAP Note 1411659 – Security fixes for SRM SUS, Vendor Evaluation, SRM ROS
Full note on SAP: SAP Support Launchpad note 887168
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].