SAP security note 1611670, “Unauthorized changes to contents displayed in SEM_UPWB”. Below are the symptom and SAP recommended solution.
Description
Symptom
A malicious user can alter the data displayed for another user by manipulating BPS planning. This exploitation could grant access to sensitive authentication information, allowing the attacker to impersonate the victim and potentially compromise all data within the application if the victim has administrative rights.
Solution
- Ensure your Basis Support Package level matches that of Note 1582870. If not, implement the corrections from that note.
- Implement this note, or import the relevant Support Package for your SAP BW version: SAP NetWeaver BW 7.00 Support Package 28 (SAPKW70028), BW 7.01 Support Package 11 (SAPKW70111), BW 7.02 Support Package 10 (SAPKW70210), BW 7.11 Support Package 8 (SAPKW71108), BW 7.30 Support Package 05 (SAPKW73005).
Reason and prerequisites
The vulnerability arises because the BPS planning module lacks adequate source code for securely outputting data via a web page, making it susceptible to reflected cross-site scripting. When a manipulated link is accessed, it can trigger the XSS, allowing the attacker to manipulate web page contents and steal session information.
References
Full note on SAP: SAP Support Launchpad note 1611670
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].