SAP Security Note
High priority
SAP security note 1689083, “Unauthorized modification of disp. content in CRM-ANA-SRV-BW”, is a program error note released on May 8, 2012. Below are the symptom and SAP recommended solution.
Description
Symptom
CRM-ANA-SRV-BW can be abused by an attacker, allowing them to modify displayed application content without authorization, and to potentially obtain authentication information from other legitimate users.
Solution
Apply this note or import the changes via the relevant support package. Remove the SICF entry and deactivate the corresponding handler class.
Reason and prerequisites
ICF service CRM_OIS within CRM-ANA-SRV-BW does not sufficiently encode output parameters, resulting in a reflected cross-site scripting issue. This can allow attackers to deface content or steal user authentication information, potentially compromising the security of the application.
Full note on SAP: SAP Support Launchpad note 1689083
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].