SAP security note 2948239, "[CVE-2020-6324] Cross-Site Scripting (XSS) Vulnerability in SAP NetWeaver AS ABAP (BSP Test Application)". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
BSP Test Application sbspext_table allows an unauthenticated attacker to send a polluted URL to the victim, enabling Reflected Cross-Site Scripting (XSS). Information available in the victim’s web browser can be read, modified, and sent to the attacker. No sensitive data is disclosed, and service disruption is not possible as the attack is limited to the test application.
Solution
The URL parameters are now properly encoded to prevent a successful XSS attack. This issue was never exploitable within productive Cloud products hosted by SAP, such as SAP S/4HANA Cloud Edition.
Reason and prerequisites
For a successful attack, the SICF service node of the relevant BSP test application must be enabled within the Application Server ABAP.
CVSS
Score 6.1 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected components
- SAP_BASIS: Versions 700 to 755 (including specific support packages listed here)
Full note on SAP: SAP Support Launchpad note 2948239
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].