SAP security note 1534115, “Potential false redirection of Web site content in BSPs”. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
The BSP applications CERTREQ and CERTMAP can be manipulated to perform phishing attacks. A malicious user can publish a URL that appears to originate from the SAP product but redirects the victim to a different URL controlled by the attacker. This deception can lead victims to disclose private data, including authentication information.
Solution
Apply the correction provided in this security note. After applying the correction, maintain the list of allowed redirection URLs in the table HTTP_WHITELIST with entry type 2 (sap-exiturl).
Reason and prerequisites
Certain pages within the BSP applications CERTREQ and CERTMAP allow cross-domain redirection. An attacker can insert a URL from an unauthorized domain into a legitimate URL sent to users. When users visit the manipulated page, they believe they are interacting with the official SAP application, while in reality, they are being redirected to a malicious domain. This can enable attackers to mimic legitimate pages, such as login screens, to harvest sensitive information like passwords. The vulnerability can be mitigated by restricting redirections to relative or local domains only.
Affected components
- SAP_BASIS 6.40
- SAP_BASIS 7.00 to 7.02
- SAP_BASIS 7.10 to 7.30
Full note on SAP: SAP Support Launchpad note 1534115
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
