PI SEC Potential disclosure of authentication information, SAP security note 1440519

SAP security note 1440519, "PI SEC: Potential disclosure of authentication information", is. Below are the symptom and SAP recommended solution.

Description

Symptom

The "Diagnostic Servlet" can be abused by a malicious user allowing them to obtain authentication information from other legitimate users.

Solution

The Diagnostic Servlet has been deleted with the following Support Packages and Patches of Software Components "XI TOOLS", "ESR" and "XI Adapter Framework".

Reason and prerequisites

You are running SAP NetWeaver Process Integration (PI). The "Diagnostic Servlet" is an undocumented, internal servlet used for system analysis. Some pages within the Diagnostic Servlet do not sufficiently encode input/output parameters, resulting in a cross site scripting issue. Cross site scripting can be used to steal another user’s authentication information such as data relating to their current session. It can be used to permanently modify displayed content from a web site, allowing the malicious user to embed content that is rendered automatically, without the need to individually target victims. An attacker who gains access to this data may use this to impersonate the user and access all information with the same rights as the target user. In case of an administrator being impersonated, a full compromise of the application’s security may occur.