Unauthorized modification in BSP application/SICF Service, SAP security note 1661568

SAP security note 1661568, "Unauthorized modification in BSP application/SICF Service". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

SRM-SUS and SRM-EBP-SHP can be abused by a malicious user, allowing them to modify displayed application content without authorization, and to potentially obtain authentication information from other legitimate users.

Cross-site scripting can be exploited to steal another user’s authentication information, such as data related to their current session. A malicious user with access to this data may impersonate the user and access all information with the same rights as the target user. If an administrator is impersonated, the application’s security may be fully compromised.

Solution

Apply this SAP Security Note 1661568 or import the changes via the relevant support package.

Reason and prerequisites

BSP applications (BBP_GLOBAL_TEST, BBP_SC_LEAN_HTML, BBP_SUS_UM, BBP_SUS_UM_SREG, BBP_SUS_WORKER, BBP_VE_SERVICE) within SRM-SUS and SRM-EBP-SHP do not sufficiently encode OUTPUT parameters, resulting in a cross-site scripting issue.

SICF services (BBP_SUS_UM, BBP_SUS_UM_SREG, BBP_SUS_WORKER, BBP_VE_SERVICE, CATALOGIMPORT, DOCSERVER, EBP, PCW, SCHEMAIMPORT) within SRM-SUS and SRM-EBP-SHP also lack sufficient OUTPUT parameter encoding, leading to XSS vulnerabilities.

CVSS

Score 4.7 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

References

• 1681906 – Unauthorized modification of displayed content in SRM-EBP
• 1669624 – SAP CRM 2005 – SP Stack 20

Affected components

• BBPCRM (versions 500, 520, 600, 700, 701, 702, 712)