Unauthorized modification in ITS-Service in SRM-EBP-CAT, SAP security note 1674027

SAP security note 1674027, "Unauthorized modification in ITS-Service in SRM-EBP-CAT", is a program error note released on May 8, 2012. Below are the symptom and SAP recommended solution.

Description

Symptom

SRM-EBP-CAT can be exploited by a malicious user to modify displayed application content without authorization. This vulnerability may allow the attacker to obtain authentication information from other legitimate users.

Solution

Apply this SAP Note or import the changes via the relevant support package to mitigate the XSS vulnerability.

Reason and prerequisites

ITS Services BBP_CT_STAGING and BBP_SCM_STAG within SRM-EBP-CAT do not sufficiently encode output parameters, resulting in an XSS vulnerability. This can be leveraged to steal authentication information, potentially allowing an attacker to impersonate users, including administrators, thereby compromising the application’s security.

References

• SAP Note 1621946: ITS: updated XSS-escaping functions
• SAP Note 1488500: ITS: automatically escape context fields in output