SAP Security Note
High priority
SAP security note 1490335, "Unauthorized change of displayed contents in XML DAS", is a program error note released on January 11, 2011. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An attacker can manipulate data of another user, which is displayed by input fields or URL paths without authorization. This may allow access to the authentication data of the affected user.
Solution
Implement comprehensive input validation and output encoding in the JSPs within the administration of the XML Data Archiving Services (XML DAS) to eliminate the vulnerability.
Reason and prerequisites
The JavaServer Pages (JSPs) in the administration of the XML Data Archiving Services (XML DAS) lack sufficient input validation and output encoding. This vulnerability allows reflected cross-site scripting attacks, enabling an attacker to manipulate the content of a web page through a crafted link.
An attacker can exploit this to steal the logon information of the victim’s current session. With this information, the attacker can impersonate the victim and access the application with the same privileges. If the victim has administrative rights, the attacker could compromise all application data.
References
Affected components
- SAP-JEE 6.40
- SAP_JTECHS 7.00 to 7.02
- J2EE-APPS 7.10 to 7.30
Full note on SAP: SAP Support Launchpad note 1490335
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
