Security Note Cross site scripting via WD URL parameters, SAP security note 1161767

SAP security note 1161767, “Cross Site Scripting via WD URL Parameters”, is released on 08.10.2009. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

In NW04 SP21 and below and in NW04S SP08 and below SP releases, Web Dynpro applications have a security vulnerability that allows cross site scripting via Webdynpro URL parameters.

Solution

This issue has been fixed in Webdynpro Runtime. The solution is available in the following support packages:

• NW04, SP23 and above.
• NW04S, SP09 and above.

Note: NW04S, EHP’s and higher releases of WebDynpro are not affected as they already contain the solution.

Additionally, the solution is available in the patches of the following releases:

• NW04, SP21 (Refer note 1120165) – SAPJTECH21P patch level 1
• NW04, SP22 (Refer note 1166463) – SAPJTECH22P patch level 1
• NW04S, SP08 (Refer note 959111) – SAPJTECHF08P patch level 15, SAPJTECHS08P patch level 16

Reason and prerequisites

Webdynpro URL parameters such as sap-wd-cltwndid, sap-wd-appwndid, and sap-ext-sid allow arbitrary HTML/Script code to be injected into the HTML output of Web Dynpro.

Affected components

• Basis Components > Web Dynpro > WebDynpro Java (BC-WD-JAV)