SAP security note 2379342, "Cross-Site Scripting (XSS) vulnerability in backup function of SAP HANA cockpit". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
The backup function in the SAP HANA cockpit does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability.
Some well-known impacts of XSS vulnerabilities are:
- Temporary defacement or modification of displayed content from a website.
- Stealing authentication information of the user, such as data relating to their current session.
- Impersonating the user and accessing all information with the same rights as the target user.
Solution
Encoding of user-controlled inputs for the backup function in HANA cockpit has been improved. The fix is included in:
- Revision 122.02 for SAP HANA SPS12
- Revision 112.07 for SAP HANA SPS11
Update to these or later versions.
Reason and prerequisites
Limiting factors for this potential vulnerability:
- Only users with a backup role (e.g., sap.hana.backup.roles::Operator) can be attacked.
- A potential attacker needs to bypass the CSRF (Cross-Site Request Forgery) protection of the application.
CVSS
Score 3.5 Vector: AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Affected components
- HDB 1.00
Full note on SAP: SAP Support Launchpad note 2379342
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].