SAP security note 2373032, “Cross-Site Scripting (XSS) vulnerability in WebClient User Interface”. Below are the symptom and SAP recommended solution.
Description
Symptom
UPDATE 7th June 2017: This note has been re-released with updated ‘Validity’ information.
The WebClient User Interface/CRM_THTMLB_UTIL does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability.
Impacts of XSS Vulnerability:
- Non-permanently deface or modify displayed content from a website
- Steal authentication information of the user, such as data relating to their current session
- Impersonate the user and access all information with the same rights as the target user
Solution
The URL parameters have been encoded to prevent XSS.
Implement the Support Packages and Patches referenced by this SAP Note.
Applying this note may cause issues with the following SAP Notes:
- 2389724 – Selection from F4 value help does not work
- 2446409 – Search does not work in F4 Value help popup
- 2436159 – Selection from F4 value help does not work – Part 3
- 2453742 – Various problems with F4 Value Help
Reason and prerequisites
The input was not being encoded.
CVSS
Score 5.4 Vector: AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Full note on SAP: SAP Support Launchpad note 2373032
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
