Unauthorized modification of BSP in Webdocuments, SAP security note 1670098

SAP security note 1670098, “Unauthorized modification of BSP in Webdocuments”, is a program error note released on 08.05.2012. Below are the symptom and SAP recommended solution.

Description

Symptom

The BSP application Webdocuments can be exploited by malicious users, allowing unauthorized modification of displayed application content and potentially obtaining authentication information from other legitimate users.

Affected BSP pages:

• DOCUMENT_CHANGE.HTM
• DOCUMENT_CREATE.HTM
• DOCUMENT_RESULTLIST.HTM
• DOCUMENT_SEARCH.HTM
• TEMP_INDEX.HTM
• LEFT_DISPLAY.HTM
• VERSIONEN.HTM

These pages within Webdocuments CA-DMS do not sufficiently encode OUTPUT parameters, resulting in a cross-site scripting (XSS) vulnerability. This can be exploited to steal another user’s authentication information, enabling impersonation and unauthorized access with the same user privileges. If an administrator is impersonated, the application’s security could be fully compromised.

Solution

Apply SAP Note 1670098 directly or import the necessary changes via the relevant support package. Ensure that all prerequisite notes are also applied based on your current release version.

CVSS

Score 0

References

• 1678243 – Unauthorized modification of BSP in Webdocuments (2)
• 1582870 – ABAP XSS Escaping Support
• 1582867 – Security options (XSS) for ESCAPE
• 1509753 – Webdocs:XSRF Protection for BSP Application WebDocuments
• 1505976 – Webdocs: Unauthorized Content Modification & Session Handling
• 1420256 – Unauthorized modification of displayed content in Webdocs