Possible XSS vulnerability in theme functionality of WebChan, SAP security note 1315240

SAP security note 1315240, “Possible XSS vulnerability in theme functionality of WebChan”, is a note released on October 8, 2009. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

This security note addresses a potential Cross-Site Scripting (XSS) vulnerability in the theme functionality of Web Channel applications. To mitigate such vulnerabilities, new restrictions have been implemented for theme names used within these applications.

Improper sanitization of certain characters in theme names may allow XSS attacks.

Solution

Theme names are now restricted to the following characters:

• Uppercase letters: A-Z
• Lowercase letters: a-z
• Space
• Minus (-)
• Plus (+)
• Underscore (_)
• Backslash (\)
• Slash (/)
• Point (.)
• Comma (,)

Any other characters will be automatically removed from the theme name. To modify this behavior, adjust the theme.core.name.filter parameter using the following navigation path: General Application Settings > Customer > application_security > application_security_config > theme.core.name.filter.

Example – Original theme name: "my very%cool.theme-here+summer@ä2000". Sanitized theme name: "my verycool.theme-here+summer2000". Characters such as %, @, and ä are removed.

Implementing this security note will remove unsupported characters from existing theme names, which may affect their appearance or functionality within Web Channel applications.

References

Affected components

• CRM-ISA (Customer Relationship Management > Internet Sales)