Unauthorized Modification in ITS-Service in PA-PA-KR, SAP security note 1655428

SAP security note 1655428, “Unauthorized Modification in ITS-Service in PA-PA-KR”. Below are the symptom and SAP recommended solution.

Description

Symptom

ITS services in application component PA-PA-KR can be abused by a malicious user, allowing them to modify displayed application content without authorization and potentially obtain authentication information from other legitimate users.

Solution

• Apply this SAP Security Note.
• Import the changes via the relevant support package.
• Implement prerequisite notes: 1621946 – ITS: updated XSS-escaping functions and 1488500 – ITS: automatically escape context fields in output.

Reason and prerequisites

ITS Services (PZ36, PZ38, PZ70, PZ81) within application component PA-PA-KR do not sufficiently encode OUTPUT parameters, resulting in a cross-site scripting (XSS) vulnerability.

Cross-site scripting can be used to steal another user’s authentication information, such as data related to their current session. A malicious user who gains access to this data may use it to impersonate the user and access all information with the same rights as the target user. If an administrator is impersonated, the security of the application may be fully compromised.

References

• 1621946 – ITS: updated XSS-escaping functions
• 1488500 – ITS: automatically escape context fields in output