SAP security note 2880869, “CVE-2020-6184 and CVE-2020-6185: XSS Vulnerabilities in SAP NetWeaver and SAP S/4HANA”. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
This SAP security note addresses several vulnerabilities identified in the ABAP Online Community Application of SAP NetWeaver and S/4HANA. The vulnerability details along with their CVE relevant information are outlined below.
Reflected Cross Site Scripting (CVE-2020-6184): Under certain conditions, the ABAP Online Community does not sufficiently encode user-controlled inputs, resulting in a Reflected Cross-Site Scripting (XSS) vulnerability.
Stored Cross-Site Scripting (CVE-2020-6185): Under certain conditions, the ABAP Online Community allows an authenticated attacker to store a malicious payload, resulting in a Stored Cross-Site Scripting (XSS) vulnerability.
Some well-known impacts of XSS include:
- Non-permanently deface or modify displayed content from a website.
- Steal authentication information of the user, such as data relating to their current session.
- Impersonate the user and access all information with the same rights as the target user.
Solution
The SAP Note provides the following corrections for the ABAP Online Community Application:
- Escaping Corrections: Properly escaping inputs to prevent malicious scripts from being executed.
- Input Validation: Validating inputs to prevent external entity (XXE) issues.
- MIME Content Checks: Using a malware scanner to check MIME content. The application uses profile /SIHTTP/HTTP_UPLOAD for scanning and requires parameters CUST_ACTIVE_CONTENT (value “1”) and CUST_CHECK_MIME_TYPE (value “1”). These are the SAP-delivered defaults.
Reason and prerequisites
The ABAP Online Community Application, built on UI5 and ABAP Push Channels, is vulnerable to cross-site scripting attacks due to:
- Missing correct escaping and input validation in some cases.
- Inadequate consistency checks of payload and MIME type of payload.
CVSS
CVE-2020-6184: Score 6.1 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVE-2020-6185: Score 5.4 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected components
- SAP_BASIS versions 740, and 750 to 754
Full note on SAP: SAP Support Launchpad note 2880869
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].