SAP security note 1596039, "Deactivate Obsolete BSP Applications to Prevent XSS Vulnerabilities", is a note. Below are the symptom and SAP recommended solution.
Description
Symptom
SAP Security Note 1596039 addresses critical vulnerabilities related to obsolete BSP (Business Server Pages) applications in the complaints processing area of the agency business module. These outdated applications can lead to functional errors and security breaches, including cross-site scripting (XSS) attacks.
The BSP applications listed below are obsolete and may result in unintended functional behaviors:
- LO_AB_CLAIMS
- LO_AB_LISTE
- LO_AB_MASTERDAT
- LO_AB_MENU
- LO_AB_REPORT
- LO_AB_USER_MGMT
- LO_AB_VND_CLAIM
- LO_AB_VND_LISTE
Additionally, these applications are susceptible to unauthorized modifications, potentially allowing attackers to persistently alter application content and access authentication information from legitimate users.
Solution
To mitigate these vulnerabilities, you must deactivate the affected BSP applications by importing the relevant Support Package. Since these applications are obsolete both functionally and from a security standpoint, they should no longer be in use.
- Import Support Package: apply the necessary Support Package specific to your software component version.
- Manual deactivation: if you prefer not to import the Support Package, you can manually comment out the layout and event handler source code or delete the entire BSP application.
- Delete service nodes: use transaction SICF to remove the service nodes associated with these BSP applications.
- Use new application: transition to the new Web Dynpro application "Complaints Workbench for Customers" available with ECC 6.00 Enhancement Package 4. Launch it using transaction WCUSPOWL.
Reason and prerequisites
The obsolete BSP applications can be exploited by attackers to:
- Modify application content without authorization.
- Persist these modifications.
- Obtain authentication information from other users.
Full note on SAP: SAP Support Launchpad note 1596039
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
