SAP security note 1673853, "Unauthorized Modification in BSP Application in IS-HER-CM", is a note. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
IS-HER-CM can be exploited by malicious users to modify displayed application content without authorization. Additionally, attackers may obtain authentication information from legitimate users, potentially leading to unauthorized access and compromised application security.
Solution
Apply this security note or import the necessary changes via the relevant support package.
Reason and prerequisites
BSP Pages such as session_advisor.htm and session_student.htm in both PIQ_DEMOTT and PIQ_DEMOMODBOOK within IS-HER-CM do not sufficiently encode OUTPUT parameters. This inadequate encoding results in a Cross-Site Scripting (XSS) vulnerability. Exploiting this vulnerability allows attackers to steal user authentication data, impersonate users, and possibly gain administrative access, thereby fully compromising the application’s security.
References
- SAP Note 1582870 – ABAP XSS Escaping Support
- SAP Note 1582867 – Security Options (XSS) for ESCAPE
- SAP Note 1491236 – Unauthorized Modification of Displayed Content SLCM BSP Appl
Affected components
- IS-PS-CA 600
- IS-PS-CA 602
- IS-PS-CA 603
- IS-PS-CA 604
- IS-PS-CA 605
- IS-PS-CA 606
- IS-PS-CA 616
Full note on SAP: SAP Support Launchpad note 1673853
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].