SAP Security Note
High priority
SAP security note 1682054, "Unauthorized Modification of Displayed Content in SRM-SUS", is a program error note released on May 8, 2012. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
A vulnerability has been identified in the SAP Supplier Relationship Management – Supplier Self-Services (SRM-SUS) component that allows unauthorized modification of displayed application content. This can potentially enable malicious users to obtain authentication information from other legitimate users through Cross Site Scripting (XSS) attacks.
Solution
Apply SAP Security Note 1682054 using SNOTE or import the changes through the relevant support package. This will address the unauthorized modification vulnerability in the SRM-SUS component.
Reason and prerequisites
The BSP applications using an extension tag rely on proper encoding. Missing or improper encoding within an extension may lead to XSS vulnerabilities in the BSP applications using the extension. Specifically, the BSP tags of the SRMSUS extension might be exploited due to missing encoding of all attribute values passed to the extension.
References
Affected components
- SRM_SERVER 702
Full note on SAP: SAP Support Launchpad note 1682054
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].