SAP Security Note
High priority
SAP security note 1672819, "Security: XSS vulnerability in SAP GUI for HTML", is a program error note released on 08.05.2012. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
PA-PA-SG service can be abused by an attacker, allowing them to modify displayed application content without authorization, and to potentially obtain authentication information from other legitimate users.
Solution
- Import Changes: Apply the relevant support package.
- Manual Corrections: Follow the instructions in the attached document "Security_Manual_Instructions.pdf".
The effectiveness of these corrections is contingent upon implementing the corrections from SAP Note 1621946 and SAP Note 1488500.
Reason and prerequisites
ITS Service HRESSSG_IR8E within PA-PA-SG does not sufficiently encode OUTPUT parameters, resulting in a cross-site scripting (XSS) issue. This vulnerability can be exploited to non-permanently deface or modify displayed content on a website.
An attacker can steal another user’s authentication information, such as data related to their current session. With this data, the attacker may impersonate the user and access all information with the same permissions as the target user. If an administrator is impersonated, the security of the entire application may be fully compromised.
References
- 1621946 ITS: updated XSS-escaping functions
- 1488500 ITS: automatically escape context fields in output
Affected components
- SAP_HRCSG 600
- SAP_HRCSG 604
Full note on SAP: SAP Support Launchpad note 1672819
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
