Unauthorized modification of content in SAP Retail Store, SAP security note 1524777

SAP security note 1524777, “Unauthorized modification of content in SAP Retail Store”, is a program error note released on 08.11.2011. Below are the symptom and SAP recommended solution.

Description

Symptom

This security note addresses two critical vulnerabilities in the SAP Retail Store:

• Reflected Cross-Site Scripting (XSS): Malicious users can modify displayed application content without authorization and potentially steal authentication information from legitimate users.
• Stored Cross-Site Scripting (XSS): Allows permanent modification of displayed content, enabling malicious users to embed content that is rendered automatically. This can lead to the theft of authentication information and unauthorized access with the same privileges as the targeted user.

Solution

The correction can be applied via a support package or through manual steps. Follow the procedures below to mitigate the vulnerabilities:

• Apply Support Packages: Refer to SAP Note 1488500 for prerequisites. If using Theme 99, also apply SAP Note 1510419.
• Manual Correction Steps: Use transaction SE80 to add the parameter ~AUTO_HTML_ESCAPING with the value X to all relevant ITS services. Eliminate HTML tags like <sup>, <font>, etc., from all language resource files across all themes and services. Replace existing HTML templates with the updated versions provided in the attachments.

References

• SAP Note 1510419 – IAC Template Library fixed for automatic HTML escaping
• SAP Note 1488500 – ITS: Automatically escape context fields in output
• SAP Note 1437902 – Unauthorized usage and modification of SAP Retail Store