Cross-Site Scripting (XSS) vulnerability in SAP CRM WebClient UI, SAP security note 2945581

SAP security note 2945581, “Cross-Site Scripting (XSS) Vulnerability in SAP CRM WebClient UI”. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

UPDATE 8th December 2020: This note has been re-released with updated ‘Correction instruction’ information. We added the prerequisite note 2542223 in the correction instruction.

UPDATE 13th October 2020: This note has been re-released with updated ‘Solution’ information. We have added the pre-implementation manual instruction in the solution section. The implementation requires a replacement of a MIME file, the existing file needs to be deleted manually before implementing the automatic instructions of the note.

SAP CRM WebClient UI does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability.

Impacts of XSS vulnerability include:

• Non-permanently deface or modify displayed content from a website
• Steal authentication information of the user, such as data relating to their current session
• Impersonate the user and access all information with the same rights as the target user

Solution

Implement the Support Packages and Patches referenced by this SAP Note.

Manual pre-implementation steps:

• Execute transaction SE80: go to Mime Repository, and navigate to the SAP -> BC -> BSP -> SAP -> WCF_JQUERY folder.
• Save a local copy of the file current.min.js and delete the current.min.js file from the WCF_JQUERY folder.
• Implement the automatic steps of the note.

Reason and prerequisites

jQuery needs to be upgraded to fix the vulnerabilities.

CVSS

Score 4.7 Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

References

• Issues when trying to implement security note 2945581

Affected components

• S4FND: Versions 102 to 105
• WEBCUIF: Versions 731, 746-801