SAP security note 1451251, "Unauthorized modification of display in Web Dynpro Trace Tool". Below are the symptom and SAP recommended solution.
Description
Symptom
The Web Dynpro Trace Tool could be abused by a malicious user, who could modify displayed application content without authorization and potentially obtain authentication information from other legitimate users.
Solution
The issue is resolved by implementing the assigned SAP Support Packages. As an interim measure, the Web Dynpro Trace Tool console can be disabled by following the correction instructions. After applying the Support Package, the Web Dynpro Trace Tool console will be available again.
Reason and prerequisites
The problem affects customers using the Web Dynpro Trace Tool, which is intended to collect SAP support-relevant information for OSS message processing. The tool can only be activated via transaction WD_TRACE_TOOL from the backend.
Pages within the Web Dynpro Trace Tool console do not sufficiently encode input parameters, resulting in a reflected cross-site scripting issue. This vulnerability can be exploited to deface or modify displayed content and steal user authentication information, potentially allowing an attacker to impersonate users, including administrators, thereby compromising the application’s security.
Full note on SAP: SAP Support Launchpad note 1451251
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
