Potential disclosure of authentication information, SAP security note 1443367

SAP security note 1443367, "Potential disclosure of authentication information". Below are the symptom and SAP recommended solution.

Description

Symptom

The "Messaging System Monitor" can be abused by a malicious user, allowing them to obtain authentication information from other legitimate users.

Solution

The described security vulnerability is corrected in the following (and newer) Support Packages:

• 3.0 SP27
• 7.00 SP23
• 7.01 SP08
• 7.02 SP04
• 7.10 SP11
• 7.11 SP05
• 7.30 SP00

For older Support Packages, the correction is available as a patch. Please update the software components of the Adapter Engine to the patch levels maintained in section "SP Patch Level" of this note or use newer versions. The archives and the support package stack guide can be found on the SAP Service Marketplace.

Reason and prerequisites

Some pages within the "Messaging System Monitor" do not sufficiently encode input parameters, resulting in a reflected cross-site scripting issue. This vulnerability can be exploited to steal another user’s authentication information, such as data relating to their current session. It can also be used to non-permanently deface or modify displayed content on a website.

An attacker who gains access to this data may impersonate the user and access all information with the same rights as the target user. If an administrator is impersonated, it may lead to a full compromise of the application’s security.

References

• 1616259 – Briefing at Black Hat conference on August 4th, 2011
• 1531912 – SAP EhP1 for XI on Netweaver 7.00 SP08
• 1530712 – NW04s XI Support Package Stack 23
• 1522687 – XI 30 Support Package Stack (SPS) 27
• 1521859 – ESR, SR, UDDI, MESSAGING related changes in 7.10 SP11