Unauthorized modif. of displayed content in WD trace tool, SAP security note 1577155

SAP security note 1577155, "Unauthorized modification of displayed content in WD trace tool", is a program error note released on July 12, 2011. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

The Web Dynpro trace tool can be exploited by a malicious user to modify displayed application content without authorization. This vulnerability may allow the attacker to obtain authentication information from other legitimate users.

Solution

• Import the appropriate Support Package for your SAP_BASIS component.
• Implement the provided correction instructions.

Reason and prerequisites

The Web Dynpro trace tool does not sufficiently encode output parameters, leading to a reflected cross-site scripting issue. An attacker can exploit this to non-permanently deface or modify displayed content on a website. Additionally, XSS can be used to steal another user’s authentication information, enabling the attacker to impersonate the user and access information with the same privileges. If an administrator is impersonated, the security of the entire application could be compromised.

References

• 888889 – Automatic checks for security notes using RSECNOTE (outdated)

Affected components

• SAP_BASIS (700, 701, 702, 710, 711, 720, 730)