Unauthorized modification of ITS in SRM-EBP-INV, SAP security note 1676123

SAP security note 1676123, “Unauthorized modification of ITS in SRM-EBP-INV”. Below are the symptom and SAP recommended solution.

Description

Symptom

SRM-EBP-INV can be exploited by a malicious user to modify displayed application content without proper authorization. This vulnerability allows the potential theft of authentication information from other legitimate users.

Solution

1. Apply Prerequisite Note: SAP Note 1655802 must be applied to your system before addressing this vulnerability.

2. Implement the Security Note: Apply SAP Security Note 1676123 directly or import the changes via the relevant support package.

3. Manual Correction Steps:

• Start Transaction SICF: Navigate to the service path /sap/bc/gui/sap/its/.
• Configure Services: Double-click on each service (e.g., bbpiv01). Click on the 'GUI Configuration' button for SRM 5.0 and higher or the 'Settings' button for SRM 4.0. Add the following service parameters: ~auto_html_escaping with value 1, ~new_xss_functions with value 1. Save the entry.
• Repeat for All Services: Ensure these steps are performed for BBPIV02, BBPIV03, BBPIV04, BBPIV05, BBPIV06, BBPIV08, and BBPIV09.

Reason and prerequisites

The ITS Services (BBPIV01 to BBPIV09) within SRM-EBP-INV do not sufficiently encode output parameters, resulting in a cross-site scripting issue. This vulnerability can be leveraged to steal another user's authentication information, such as session data. An attacker with access to this data can impersonate the user, potentially compromising the entire application's security.

If an administrator is impersonated, the security of the entire application may be fully compromised, allowing unauthorized access to sensitive information and functionalities.