SAP security note 1670220, “Unauthorized Modification of ITS in IS-HER-CM”. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
IS-HER-CM can be abused by a malicious user, allowing modification of application content and potential theft of authentication data.
A cross-site scripting (XSS) vulnerability in IS-HER-CM allows malicious users to modify displayed application content without authorization and potentially steal authentication information from other legitimate users. This can lead to user impersonation and full compromise of application security if an administrator is impersonated.
Solution
Apply this security note or import the changes via the relevant support package.
Reason and prerequisites
The ITS Service PIQCMADM_DE within IS-HER-CM does not sufficiently encode OUTPUT parameters, resulting in an XSS issue.
References
- ABAP XSS Escaping Support
- Security options (XSS) for ESCAPE
- ITS: Automatically Escape Context Fields in Output
Affected components
- IS-PS-CA 600
- IS-PS-CA 602
- IS-PS-CA 603
- IS-PS-CA 604
- IS-PS-CA 605
- IS-PS-CA 606
- IS-PS-CA 616
Full note on SAP: SAP Support Launchpad note 1670220
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
