SLC Unauthorized modification in BSP application, SAP security note 1674902

SAP security note 1674902, "SLC: Unauthorized modification in BSP application", was released on 08.05.2012. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

Application Components SLC-SUP, SLC-QUA, and SLC-REG can be abused by a malicious user, allowing them to modify displayed application content without authorization and potentially obtain authentication information from other legitimate users.

Solution

Implement the corresponding support package or apply the correction instructions.

Reason and prerequisites

BSP Pages (default.htm) within BSP applications do not sufficiently encode OUTPUT parameters, resulting in a cross-site scripting vulnerability.

Affected BSP applications:

• /SRMSMC/PUC_INT
• /SRMSMC/QUA_CMN
• /SRMSMC/ROS_EXT
• /SRMSMC/S3Q_EXT
• /SRMSMC/SUP_DELTA

Cross-site scripting can be exploited to steal another user’s authentication information, such as data related to their current session. A malicious user who gains access to this data may use it to impersonate the user and access all information with the same rights as the target user. If an administrator is impersonated, the security of the application may be fully compromised.

References

• SAP Note 1686821 – Unauthorized modification of displayed content in SLC-SUP

Affected components

• SRMSMC 100