SAP security note 1671087, “Unauthorized modification of display content in MKT Calendar”. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
The application components MKTCALENDAR and MKTCALENDAR_NEW are susceptible to XSS attacks, enabling unauthorized modification of displayed content and the possibility of stealing user authentication information.
Successful exploitation can allow attackers to deface or modify website content and steal session-related authentication information, potentially enabling impersonation of users, including administrators, thereby compromising application security.
Solution
To mitigate this vulnerability, apply SAP Security Note 1671087 or import the necessary changes via the relevant support package. Ensure that all affected software components are updated to the recommended support package versions.
Reason and prerequisites
Insufficient encoding of parameters such as LV_CHARSET, URLBASECONTROLERSTATELESS, URLBASECONTROLER, and BASEADR in CALENDARAPPLET.HTM leads to XSS vulnerabilities. Similarly, parameters like DISPLAY_URL in MKTPROJFLEXRESULT.HTM and MKTPROJFLEXRESULTS.HTM are not properly encoded. Additionally, outdated XML encoding methods and unverified communication between Java Applets and the MKTCALENDAR component exacerbate the issue.
References
- SAP Note 1671470 – BSP: Design2008 for release 7.00 and 7.01
- SAP Note 1582870 – ABAP XSS Escaping Support
- SAP Note 1582867 – Security options (XSS) for ESCAPE
Affected components
- BBPCRM 520
- BBPCRM 600
- BBPCRM 700
- BBPCRM 701
- BBPCRM 702
- BBPCRM 712
Full note on SAP: SAP Support Launchpad note 1671087
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].