Unauthorized modification of displayed content in the Workflow Modeler, SAP security note 1860923

SAP security note 1860923, "Unauthorized modification of displayed content in the Workflow Modeler", is a note. Below are the symptom, SAP recommended solution and affected software components.

Description

Symptom

Workflow Modeler can be abused by an attacker, allowing them to modify displayed application content without authorization, and to potentially obtain authentication information from other legitimate users.

Solution

You should deactivate the affected component, which is obsolete. The deactivation is a component of the following Support Packages:

The component is no longer contained in NW 7.10 and later.

If you are unable to install these Support Packages, you should deactivate the application tc~workflowmodeler in the administration work center or block access to the path /Modeler/*.

• NW 6.40 from Support Package 29
• NW 7.00 from Support Package 27
• NW 7.01 from Support Package 12
• NW 7.02 from Support Package 15

Reason and prerequisites

Input parameters within Workflow Modeler are not sufficiently encoded by WorkflowModeler.jsp, resulting in a reflected cross-site scripting issue. A reflected cross-site scripting attack can be used to non-permanently deface or modify displayed content from a website.

Reflected cross-site scripting can be used to steal another user’s authentication information, such as data relating to their current session. An attacker who gains access to this data may use it to impersonate the user and access all information with the same rights as the target user. If an administrator is impersonated, the security of the application may be fully compromised.

CVSS

Score 4.3 Vector: AV:N/AC:M/AU:N/C:N/I:P/A:N

Affected components

• SAP-JEE: 6.40
• SAP_JTECHS: 6.40, 7.00 to 7.02