Some Fields are susceptible to Cross-site scripting, SAP security note 1335926

SAP security note 1335926, “Some Fields are susceptible to Cross-site scripting”, is a note released on 12.10.2009. Below are the symptom, reason and prerequisites, SAP recommended solution, related references and noted side effects.

Description

This SAP Security Note addresses a Cross-site scripting (XSS) vulnerability present in several fields within the Supplier Relationship Management (SRM) module. Specifically, when entering dynamic attribute descriptions or other field descriptions with malicious scripts, the system fails to mask these inputs correctly, allowing the execution of unauthorized scripts.

Symptom

When a Bid invitation is created with a dynamic attribute description containing a script (e.g., <a href="javascript:alert();">Click me!</a>), the system displays a dialog box with the injected text instead of executing the script. This issue also affects other descriptions such as Partner details, Bidder output data details in Bid invitations, and Incoterm Descriptions in Quotations.

Solution

To resolve this issue, you should:

• Import the relevant Support Package: for SRM_SERVER 500, SAPKIBKS16; for SRM_SERVER 550, SAPKIBKT16.
• Implement the attached correction instructions.

Reason and prerequisites

The vulnerability is due to a program error where certain fields are not properly masked, allowing malicious scripts to be executed.

Side effects

This document is causing side effects in Error thrown if Printer name has special characters or space.

References

• Automatic checks for security notes using RSECNOTE (outdated)