SAP security note 887164, “BSP Test Applications in Production Systems”. Below are the symptom, SAP recommended solution and the affected software components.
Description
SAP Security Note 887164 addresses a critical security issue related to Business Server Pages (BSP) test applications in production environments. These applications are vulnerable to Cross-Site Scripting (XSS) attacks due to insufficient input validation and output encoding.
Symptom
XSS attacks can occur when malicious HTML and JavaScript are injected into form fields and echoed back to the browser. This vulnerability arises because the BSP applications do not validate all input and fail to HTML encode output before sending it to the browser.
Solution
To mitigate the risk of XSS attacks, it is strongly recommended to disable all unnecessary BSP test applications in production systems. Specifically, the following ICF nodes should be deactivated using transaction SICF:
- SBSPEXT_HTMLB
- SBSPEXT_XHTMLB
- SBSPEXT_PHTMLB
- SBSPEXT_TABLE
- HTMLB_SAMPLES
- BSP_MODEL
- ITMVC2
- IT00
- IT01
- IT02
- IT03
- IT04
- IT05
- ITSM
- SYSTEM_PUBLIC
- SYSTEM_PRIVATE
Disabling these nodes helps secure your production environment by removing unused and potentially vulnerable applications.
Future Support Packages will include HTML encoding enhancements for these test applications: 620SP57, 640SP15, 700SP06.
- Access transaction SICF in your SAP system.
- Navigate to the ICF nodes listed above.
- Deactivate each unnecessary BSP test application.
References
Affected components
- SAP_BASIS: Versions 610 to 640, 700, 710
Full note on SAP: SAP Support Launchpad note 887164
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
