Unauthorized modification in ITS-Service, SAP security note 1655538

SAP security note 1655538, “Unauthorized Modification in ITS-Service”. Below are the symptom and SAP recommended solution.

Description

Symptom

ITS Services (TS_WS01200170H, WS01000060) can be abused by a malicious user, allowing them to modify displayed application content without authorization, and to potentially obtain authentication information from other legitimate users.

Solution

The corrections in this note are only for security enhancement and do not change any current functionality.

The corrections of this note do only have a protecting effect if the corrections of Note 1621946 and Note 1488500 are implemented.

If you need the security enhancement, you may apply the changes via the relevant support package or follow the manual steps below:

• Login to the system and go to Maintain Services (use the sicf transaction code).
• Input the service name TS_WS01200170H and execute the program.
• Double-click the TS_WS01200170H service on the list.
• Change the TS_WS01200170H service and click the GUI Configuration button.
• Add the two parameters as follows if they do not exist: ~auto_html_escaping = 1, ~new_xss_functions = 1.
• Repeat the same correction for the WS01000060 service.

Reason and prerequisites

ITS Services (TS_WS01200170H, WS01000060) do not sufficiently encode OUTPUT parameters, resulting in a cross-site scripting issue.

Cross-site scripting can be used to steal another user’s authentication information, such as data relating to their current session. A malicious user who gains access to this data may use it to impersonate the user and access all information with the same rights as the target user.

If an administrator is impersonated, the security of the application may be fully compromised.

References

• Note 1621946 – ITS: updated XSS-escaping functions
• Note 1488500 – ITS: automatically escape context fields in output