SAP Note 1240538
SAP Security Note
Low priority
SAP Security Note
Low priority
SAP security note 1240538, “Improving URL filter for sap-themeRoot”, is a program error note released on 08.10.2009. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
When the sap-themeRoot parameter is formatted as &sap-themeRoot=//evil.host/, the browser incorrectly treats evil.host as a hostname included in the whitelist. The filter appears to function as expected under these conditions.
Solution
Implement the support package mentioned below to resolve the issue.
Affected components
- SAP_BASIS: Versions 640 to 640, 700 to 702, 710 to 720
Full note on SAP: SAP Support Launchpad note 1240538
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].