Unauthorized modification of displayed content in CA-GTF-DOB, SAP security note 1661783

SAP security note 1661783, "Unauthorized modification of displayed content in CA-GTF-DOB". Below are the symptom and SAP recommended solution.

Description

Symptom

CA-GTF-DOB can be abused by an attacker, allowing them to modify displayed application content without authorization and potentially obtain authentication information from other legitimate users.

Solution

Apply SAP Note 1661783 or the corresponding support package to resolve this security issue. The note includes a XSS check for the necessary output parameters.

Reason and prerequisites

The page within CA-GTF-DOB does not sufficiently encode output parameters, resulting in a reflected cross-site scripting vulnerability. This can be exploited to deface or modify displayed content on a website temporarily. Additionally, XSS can be used to steal another user’s authentication information, which may allow attackers to impersonate the user and access data with the same rights. If an administrator is impersonated, the application’s security could be fully compromised.