Redirection of Web site in Xcelsius may be incorrect, SAP security note 1412864

SAP security note 1412864, "Redirection of Web site in Xcelsius may be incorrect". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

This SAP Note has already been released as a normal SAP Note that is not a Security Note. No further activities are required if you have already implemented this SAP Note.

Xcelsius Dashboards can be used for phishing attacks by allowing an attacker to publish a URL purporting to be from the product, which redirects the victim to a URL chosen by the attacker. This enables an attacker to falsely gain the trust of a victim and elicit private data from them (such as authentication information).

Solution

The Adobe Flash Player requires that a crossdomain.xml file is stored on the server in the case of a Web service call from a Flash file. This crossdomain.xml description is used to ensure that the requesting ShockWave Flash (SWF) is also authorized to retrieve data from the server.

For the Xcelsius scenario, an appropriate crossdomain.xml has already been delivered in the BICS Web service deployment. This cannot be changed because it is returned by a servlet. The servlet can be accessed using the following alias: http://<host>:5<instanceNr>00/bicsremotecrossdomain.xml

By default, crossdomain.xml does not need to be adjusted. If specific security settings are required for the Xcelsius dashboards, bicsremotecrossdomain.xml may be overwritten when an appropriate crossdomain.xml is created in the root of the application server.

Reason and prerequisites

Some pages within Xcelsius Dashboards enable a cross-domain redirection to occur. An attacker can include a URL from a different domain in a URL of the target application, which can then be sent to a user of the target application. The user thinks that the content is from the target application, but when they visit such a page, the content is delivered from the domain chosen by the attacker. The attacker can then mimic pages of the target application (for example, a logon page) to get the victim to disclose information they would not otherwise reveal to the attacker (such as their password). This can be mitigated by restricting redirections to relative or local domains only.

CVSS

Score 4.3 Vector: AV:N/AC:M/AU:N/C:N/I:P/A:N

References

• 1427653 – NW 7.01 SP 06 Patch Level (PL) 10 for BI Java
• 1427622 – NW7.0 SPS 21 Patch 10 note for BI Java
• 1407878 – SAPBINEWS NW7.01 BI JAVA SP07
• 1407877 – NW 7.01 SP 05 Patch Level (PL) 30 for BI Java
• 1404370 – NW7.0 SPS 20 Patch 30 note for BI Java
• 1387279 – SAPBINEWS NW7.11 BI JAVA SP05
• 1309000 – NW 7.01 and NW 7.02: BI Java Patch Delivery
• 1033246 – NW 7.0 (NW04s): BI Java Synchronized Patch Delivery
• 1011241 – Patches for NetWeaver 2004s BI Java Support Package

Affected components

• BI-BASE-S from 7.00 to 7.02, 7.11
• SAP_BW from 700 to 702, 711
• BIWEBAPP from 7.00 to 7.02, 7.11