Unauthorized modification in ITS-Service WEB_PRICAT, SAP security note 1694781

SAP security note 1694781, "Unauthorized Modification in ITS-Service WEB_PRICAT", is a program error note released on 12.06.2012. Below are the symptom and SAP recommended solution.

Description

Symptom

WEB_PRICAT can be abused by a malicious user, allowing unauthorized modification of displayed application content and potential theft of authentication information from legitimate users through cross-site scripting (XSS).

Solution

• Apply this SAP Note (1694781).
• Implement corrections from the following notes:
  • SAP Note 1621946 – ITS: updated XSS-escaping functions
  • SAP Note 1488500 – ITS: automatically escape context fields in output

Reason and prerequisites

The ITS Service WEB_PRICAT within SD-EDI does not sufficiently encode output parameters, leading to an XSS vulnerability.

• Attackers can steal user session data and impersonate users.
• Compromised sessions can grant attackers the same access rights as the targeted users.
• If an administrator's session is compromised, the entire application's security may be at risk.

References

• SAP Note 1621946 – ITS: updated XSS-escaping functions
• SAP Note 1488500 – ITS: automatically escape context fields in output