SAP security note 1701662, “Unauthorized modification of displayed content in Web Request”. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
Web Request pages can be abused by an attacker, enabling unauthorized modification of displayed content and possible theft of authentication information from legitimate users.
Solution
- Apply the SAP Note: Ensure that SAP Note 1701662 is implemented in your system.
- Manual Pre-Implementation Steps for Release 640.
- Go to transaction SE24 and open class CL_UWS_FORM_RUNTIME_BSP_SCR.
- Press the “Change” button for the class.
- Create a new method named GETU with the following properties: Level: Instance method, Visibility: Public.
- Define the method parameters: ID_PATH (Importing, Type: UXS_XPATH_EXPRESSION), RD_VALUE (Returning, Optional, Type: String).
- Save and activate the class after making the changes.
Reason and prerequisites
The issue arises because CRM Web Request pages and applications do not sufficiently encode input/output parameters, resulting in a reflected XSS vulnerability. An attacker can exploit this to deface or modify website content temporarily or steal authentication data, potentially leading to user impersonation and full application compromise, especially if an administrator is targeted.
References
- 1665004: Unauthorized modification of BSPs in CRM Grantor Management
- 1659560: Unauthorized Modification of Displayed Content in CRM-ISE-WBF
Affected components
- SAP_ABA 640
- SAP_ABA 700 to 702
- SAP_ABA 710 to 711
- SAP_ABA 730
- SAP_ABA 731
Full note on SAP: SAP Support Launchpad note 1701662
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
