SAP security note 1676934, “Malicious modification of SRM attachment url.”. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
SRM attachments can be abused by an attacker, allowing them to modify displayed application content without authorization and potentially obtain authentication information from other legitimate users.
Solution
Implement the attached corrections or import the corresponding support package.
Reason and prerequisites
This problem is caused by a program error. Within SRM attachment functionality, some input and output parameters do not sufficiently encode, resulting in a reflected cross-site scripting issue. A reflected XSS attack can be used to non-permanently deface or modify displayed content from a website. Additionally, it can steal another user’s authentication information, such as data relating to their current session, allowing an attacker to impersonate the user and access all information with the same rights. If an administrator is impersonated, the security of the application may be fully compromised.
CVSS
Score 0
Affected components
- SRM_SERVER 500
- SRM_SERVER 550
- SRM_SERVER 600
- SRM_SERVER 700
- SRM_SERVER 701
- SRM_SERVER 702
Full note on SAP: SAP Support Launchpad note 1676934
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].