Unauthorized modificat. of displayed content in SRM-EBP-WFL, SAP security note 1665973

SAP security note 1665973, “Unauthorized modification of displayed content in SRM-EBP-WFL”, is a note released on 08.05.2012. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

The SRM component SRM-EBP-WFL includes the internet ITS service BBPWI, which must be secured against Cross-Site Scripting (XSS) attacks. The existing and new dynpro variables used by the service need to be HTML encoded to prevent unauthorized modification of displayed content.

Solution

For SRM_SERVER 550:

• Implement the relevant support package or follow the correction instructions.
• Execute the report SRM_ITS_XSS_PARAM to add the new SICF-GUI parameters that control encoding behavior for the Internet Services mentioned in the note.

For SRM_SERVER 500:

• Implement the relevant support package or follow the correction instructions.
• Set the ITS parameters ~AUTO_HTML_ESCAPING = 1 and ~NEW_XSS_FUNCTIONS = 1 to enable encoding.

The protections offered by this note require the implementation of SAP Notes 1621946 and 1488500.

Reason and prerequisites

The ITS Service BBPWI for the SRM-EBP-WFL component does not sufficiently encode output parameters, leading to a vulnerability that allows for XSS attacks. An attacker exploiting this vulnerability can steal user authentication information, potentially impersonating users and compromising the security of the application, including administrative accounts.

CVSS

Score 0

References

• SAP Note 1621946 – ITS: Updated XSS-Escaping Functions
• SAP Note 1488500 – ITS: Automatically Escape Context Fields in Output

Affected components

• SRM_SERVER 500 to 500
• SRM_SERVER 550 to 550