SAP security note 2360488, “Cross-Site Scripting (XSS) vulnerability in Fiori Launch Pad on Enterprise Portal”. Below are the symptom and SAP recommended solution.
Description
Symptom
Fiori Launch Pad on Enterprise Portal does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability.
Some well-known impacts of XSS vulnerability are:
- Non-permanently deface or modify displayed content from a website
- Steal authentication information of the user, such as data relating to their current session
- Impersonate the user and access all information with the same rights as the target user
Solution
Input validation has been added using UI5 URL validation. Refer to the Support Packages & Patches link to view the versions including the fix.
Reason and prerequisites
Your support package (SP) and patch level for the relevant components are lower than the SP/patch combination which fixes this issue for your portal version. The specific SPs and patches containing the fix are visible in the “Support Packages & Patches” section of this note.
Reason: No input validation of URLs.
CVSS
Score 6.1 Vector: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
Full note on SAP: SAP Support Launchpad note 2360488
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].