SAP security note 1671334, “Security: XSS vulnerability in SAP GUI for HTML”. Below are the symptom and SAP recommended solution.
Description
Symptom
- Unauthorized modification of application content.
- Potential theft of authentication information from legitimate users.
Solution
To mitigate this vulnerability, import the relevant support package that includes the necessary security fixes, and perform manual corrections as detailed in the attached document security_manual_instructions.pdf.
The effectiveness of these corrections depends on the implementation of SAP Note 1621946 and SAP Note 1488500. Ensure both are applied to fully secure the system.
Reason and prerequisites
The vulnerability arises because ITS Services (HRESSIN_F16, PZ80, PZ88) within PA-PA-IN do not sufficiently encode output parameters. This lack of proper encoding results in a cross-site scripting issue, which can be exploited to steal user authentication data. If an administrator’s account is compromised, the security of the entire application may be fully breached.
References
- SAP Note 1621946 – ITS: updated XSS-escaping functions
- SAP Note 1488500 – ITS: automatically escape context fields in output
Full note on SAP: SAP Support Launchpad note 1671334
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
