Security gap in Cross-Site-Scripting, SAP security note 960728

SAP security note 960728, "Security gap in Cross-Site-Scripting", is a program error note released on 08.10.2009. Below are the symptom and SAP recommended solution.

Description

Symptom

When you call SAP E-Recruiting or when SAP E-Recruiting is running, any JavaScript code can be executed using the URL parameter sap_bsp_fw_active.

To exploit this vulnerability, attach the following character string to the URL in the address bar of the browser (without the quotes): &sap_bsp_fw_active=true’);alert(‘XSS’);//

When you access the modified URL, the JavaScript code is executed, and a JavaScript alert with the text "XSS!" appears.

Solution

Implement the correction instructions provided in this SAP Note or import the relevant Support Package to address the security gap.

Reason and prerequisites

There is a program error that allows for this Cross-Site Scripting (XSS) vulnerability.

References

• 915538 – Session management in portal environment
• 921370 – Session timeout: Start page identifier disappears
• 957038 – Security gap in cross-site scripting
• 908218 – Session handling in SAP E-Recruiting