Cross-Site Scripting (XSS) vulnerability in ABAP Server and ABAP Platform, SAP security note 2774742

SAP security note 2774742, "Cross-Site Scripting (XSS) vulnerability in ABAP Server and ABAP Platform". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

ABAP Server and ABAP Platform do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.

Some well-known impacts of XSS vulnerability are:

• Non-permanently deface or modify displayed content from a website
• Steal authentication information of the user, such as data relating to their current session
• Impersonate the user and access all information with the same rights as the target user

Solution

With the correction provided, the content management system supports the response parameter Content-Disposition with the value attachment for files retrieved.

Customers may revert to the formerly used label inline at their own risk by following the steps below.

ABAP Server versions 7.00 to 7.50:

• Execute Transaction SE11
• Select ‘Domain’
• Enter Domain name SDOK_PFNAM
• Go to the tab ‘Value Range’
• Add a new value CNTDISP
• Short Description: Content Disposition (inline or attachment)

ABAP Platform versions 7.51 to 7.53:

• Execute the Transaction SE16
• Table Name: SDOKPROF
• Maintain an entry in the table with the following Key: NAME: CNTDISP, VALUE: attachment

You have to perform this manual post-implementation step manually and separately in each system after you have imported the Note to implement.

• Execute Transaction SE16
• Table Name: SDOKPROF
• Add an entry with: NAME: CNTDISP, VALUE: attachment

Reason and prerequisites

Content requested from the browser application and retrieved from content management may fail to mark content correctly for the browser, and as such might be activated and executed immediately by the browser.

Previously, the content management system used the Response header parameter Content-Disposition with the value inline for files sent to the browser. This behavior was seen as insecure.

With this SAP Security Note, a new feature is provided that allows customers to decide between the inline and attachment label. The label to be used is configurable.

CVSS

Score 6.1 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected components

• SAP_BASIS 700 to 753