SAP Security Note
Low priority
SAP security note 705187, "Cross Site Scripting (XSS)", is a consulting note released on December 8, 2010. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
This security note addresses a Cross Site Scripting (XSS) vulnerability where user entries are not properly encoded, allowing the injection and execution of malicious JavaScript in BSP pages. This can lead to unauthorized access to browser-managed cookies, which can be exploited to transfer cookie contents to another web page.
This security note is obsolete and has been replaced by SAP Notes 822881 and 887168.
Solution
To mitigate this vulnerability, ensure that all user inputs are properly HTML encoded before processing in ABAP. This prevents the execution of malicious scripts. Specific instructions include modifying the ON_REQUEST method of the CL_BSP_RUNTIME class to include form field encoding, as detailed in the note.
References
- 1061439 – Cross Site Scripting (XSS), encoding user entries
- 928534 – Receiver field cleared while sending E-Mail
Affected components
- SAP_BASIS: from version 620 to 640
Full note on SAP: SAP Support Launchpad note 705187
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
