Cross site scripting in JSF, SAP security note 1252546

SAP security note 1252546, "Cross site scripting in JSF", is a note. Below are the symptom and SAP recommended solution.

Description

Symptom

This SAP Security Note addresses a potential Cross-Site Scripting (XSS) vulnerability in JavaServer Faces (JSF) applications within the NetWeaver Application Server Java.

Insecure JSF code where user input is not properly validated can allow attackers to inject malicious scripts. This is particularly risky when rendering backing bean properties into attribute values, such as in <h:outputText>, <h:outputLink>, or <h:graphicImage> tags.

Solution

• Upgrade JSF framework: ensure that your JSF framework is version 1.2_08 or higher, as these versions include output encoding to prevent XSS attacks.
• Apply correction: for versions lower than Enhancement Package 1 (EhP1), apply the provided correction archive ec~java~jsf.sda included in this note.
• ICM filter mechanism: configurable standard pattern filters can block direct script injections like <script>…</script> or javascript:…
• SAP component library for JSF: utilizes Unified Rendering with output encoding to ensure secure handling of attributes.

Reason and prerequisites

If user inputs are not checked at the application level, it may be possible to exploit XSS vulnerabilities leading to potential data breaches or unauthorized actions.

References

• SAP NetWeaver Developer’s Guide: Secure Programming Java
• Security Quick Guide
• OWASP Cross-Site Scripting (XSS)