Security Note, Information, Input Output Validation, SAP security note 1420608

SAP security note 1420608, "Security Note, Information, Input Output Validation", is a note. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

The SAP Business Objects Enterprise Java Web Portal can be abused by a malicious user allowing them to obtain authentication information from other legitimate users.

In addition, the product can be used to aid in phishing attacks by allowing a malicious user to publish a URL purporting to be from the SAP Business Objects Enterprise Java Web Portal, only to redirect the user to a URL of their own choosing.

The affected release is SAP Business Objects Enterprise Java Web Portal (release XIR2, XIR3, and XIR3.1).

Solution

For customers on XIR3.1, XIR3 FP2.3 should be installed to resolve the cross-domain redirection and cross-site scripting issues.

For customers on XIR2, XIR2 FP5.6 should be installed to resolve the cross-domain redirection and cross-site scripting issues.

The following pages should be manually removed to avoid information disclosure from the webservices war file:

• ActivateService.jsp
• admin.jsp
• disengage.jsp
• EngageToServiceGroup.jsp
• engagingglobally.jsp
• engagingtoanoperation.jsp
• engagingtoaservice.jsp
• errorModule.jsp
• globalModules.jsp
• HappyAxis.jsp
• InActivateService.jsp
• LeftFrame.jsp
• listFaultyService.jsp
• listGroupService.jsp
• listModules.jsp
• listService.jsp
• ListServiceGroup.jsp
• listSingleService.jsp
• Login.jsp
• MainFrame.jsp
• SelectService.jsp
• ServiceParaEdit.jsp
• TopFrame.jsp
• upload.jsp
• ViewContexts.jsp
• ViewGlobalHandlers.jsp
• viewphases.jsp
• viewServiceContext.jsp
• viewServiceGroupContext.jsp
• ViewServiceHandlers.jsp

Also, the following page from the CMC war file should be removed:

• /CmcApp/App/sesInfo.jsp

Reason and prerequisites

Some pages within the SAP Business Objects Enterprise Java Web Portal do not sufficiently encode input parameters, resulting in a reflected cross-site scripting issue and cross-domain redirection vulnerabilities.

Reflected cross-site scripting can be used to steal another user’s authentication information such as data relating to their current session or can be used to non-permanently deface a website. An attacker who gains access to this data may use it to impersonate the user and access all information with the same rights as the target user. In the case of an administrator being impersonated, a full compromise of the application’s security may occur.

Cross-domain redirection attacks enable a malicious user to specially craft a URL to appear as if it is within the SAP Business Objects Enterprise Java Web Portal, however, it is a page of the malicious user’s choosing.

Affected components

• BOBJ-BIP-ADM: XI R2 SP4 FixPack 4.10, XI R2 SP5 FixPack 5.6, XI R3.1 SP1 FixPack 1.7, XI R3.1 SP2 FixPack 2.2
• BOBJ-BIP-PM: XI R2 SP4 FixPack 4.10, XI R2 SP5 FixPack 5.5, XI R3.1 SP1 FixPack 1.7, XI R3.1 SP2 FixPack 2.2
• BOBJ-ERQ-CR: XI R2 SP4 FixPack 4.10, XI R2 SP5 FixPack 5.5, XI R3.1 SP1 FixPack 1.7, XI R3.1 SP2 FixPack 2.2
• BOJ-ERQ-WBI: XI R2 SP4 FixPack 4.10, XI R2 SP5 FixPack 5.5, XI R3.1 SP1 FixPack 1.7, XI R3.1 SP2 FixPack 2.2