Portal XSS Encoding Library – StringUtils, SAP security note 1615941

SAP security note 1615941, "Portal XSS Encoding Library – StringUtils", is a note released on May 8, 2012. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

Enterprise Portal is vulnerable to reflected Cross-Site Scripting (XSS) attacks due to insufficient encoding of output parameters by the deprecated StringUtils library. A malicious user can exploit this vulnerability to modify displayed application content without authorization and potentially steal authentication information from other legitimate users.

Solution

To address this vulnerability, follow one of the following approaches:

• Migrate to the new XSS encoding library (recommended): update your implementations to use the new XSS encoding library as detailed in SAP Note 866020.
• Enable the portal XSS switch: if updating your code is not feasible, enable the portal XSS switch by adding the system parameter com.sap.portal.security.xssencode=1 to the JVM using the Config Tool. This setting delegates all calls to the deprecated StringUtils API to the new XSSEncoder library, enhancing XSS protection.

Important: continuing to use the deprecated StringUtils library may leave your portal vulnerable to XSS attacks.

References

• HTMLB: SAP Note 1653473
• WD JAVA: SAP Note 1653474
• XSS Encoding Guide: SAP Note 866020

Affected components

• EP-PIN (Enterprise Portal (On Premise)), versions 6.0_640 to 7.31