Potential false redirection of web site content in B2B 0CI, SAP security note 1487217

SAP security note 1487217, "Potential false redirection of web site content in B2B 0CI". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

One Step Business Scenario (SRM) can be used to aid in phishing attacks by allowing a malicious user to publish a URL purporting to be from the product, only to redirect the user to a URL of their own choosing. This can enable a malicious user to falsely gain the trust of a victim to elicit private data from that user, such as authentication information.

Solution

This note contains Java corrections for E-Commerce and CRM Web Channel.

• Software components: SAP-SHRJAV, SAP-SHRWEB
• Development components: crm/isa/isacore, crm/tc/web/core
• Changed files: OciLinesSendAction.java, general-security-config-data.xml, xcmadmin-security-config.xml

Configuration

In addition, maintain the allowed callback URLs of the calling application, for example, the SAP Enterprise Buyer Professional (EBP) application in Extended Configuration Management (XCM) of the B2B application.

• Go to General Application Settings – Customer – application_security.
• Choose application_security_config.
• Maintain the callback URL (HOOK URL) in the field oci.core.url.list. Add a list of all possible callback URLs separated by a comma (for example, http://server1-name:port, http://server2-name:port) that use the B2B Web shop as an external catalog.

Reason and prerequisites

Some pages within the One Step Business Scenario of the Web Channel B2B application enable a cross domain redirection to occur. A malicious user can include a URL from a different domain to the target application into a URL which can then be sent to users of the target application. The user believes the content to be delivered from the target application (the B2B or the SRM application), however, when such a page is visited, content is delivered from the domain of the malicious user’s own choosing.

CVSS

Score 0

Affected components

• SAP-CRMJAV 5.0 – 5.0
• SAP-CRMJAV 5.2 – 5.2
• SAP-CRMJAV 6.0 – 6.0
• SAP-SHRAPP 701 – 701
• (Complete list available in the original SAP note)