SAP security note 2945581, “Cross-Site Scripting (XSS) Vulnerability in SAP CRM WebClient UI”. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
UPDATE 8th December 2020: This note has been re-released with updated ‘Correction instruction’ information. We added the prerequisite note 2542223 in the correction instruction.
UPDATE 13th October 2020: This note has been re-released with updated ‘Solution’ information. We have added the pre-implementation manual instruction in the solution section. The implementation requires a replacement of a MIME file, the existing file needs to be deleted manually before implementing the automatic instructions of the note.
SAP CRM WebClient UI does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability.
Impacts of XSS vulnerability include:
- Non-permanently deface or modify displayed content from a website
- Steal authentication information of the user, such as data relating to their current session
- Impersonate the user and access all information with the same rights as the target user
Solution
Implement the Support Packages and Patches referenced by this SAP Note.
Manual pre-implementation steps:
- Execute transaction SE80: go to Mime Repository, and navigate to the SAP -> BC -> BSP -> SAP -> WCF_JQUERY folder.
- Save a local copy of the file current.min.js and delete the current.min.js file from the WCF_JQUERY folder.
- Implement the automatic steps of the note.
Reason and prerequisites
jQuery needs to be upgraded to fix the vulnerabilities.
CVSS
Score 4.7 Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
References
Affected components
- S4FND: Versions 102 to 105
- WEBCUIF: Versions 731, 746-801
Full note on SAP: SAP Support Launchpad note 2945581
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
