Security XSS vulnerability in ITS 6.20, SAP security note 1385621

SAP security note 1385621, "Security: XSS vulnerability in ITS 6.20", is a note. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

ITS 6.20 contains a cross-site scripting (XSS) vulnerability on the login page. If a service name with specially encoded characters is selected instead of a standard service name like WEBGUI, the embedded JavaScript code can be executed within the context of the login page.

Solution

Apply Patch 35: This patch is available for download from the SAP Service Marketplace.

Manual code correction: For ITS servers using patch level 34 or lower, and before patch 35 is available, implement the following source code corrections:

• Windows path: \Program Files\SAP\ITS\6.20\<INSTANCE>\templates\system\dm\login.html
• Linux path: /usr/sap/its/6.20/<INSTANCE>/templates/system/dm/login.html
• After the line include( ~service="system", ~theme="dm", ~language="", ~name="its_util.html"); add: mywgateurl = wgateurl(); mywgateurl = strmask(mywgateurl); (ensure that the accent grave character is not deleted).
• Replace all calls to wgateURL() with mywgateurl (again, ensure that the accent grave character is not deleted).

After making these changes, use the ITS administration tool to invalidate the template cache or restart the relevant ITS instance.

Affected components

• BC-FES-ITS – Version 6.20 (Valid From 620 to 620)