Unauthorized modification in ITS-Services of ISR, SAP security note 1674219

SAP security note 1674219, "Unauthorized Modification in ITS-Services of ISR", is a note released on May 8, 2012. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

A vulnerability exists in the ITS-Services of the "Internal Service Request (ISR)" tool within the above components. A malicious user can exploit this flaw to:

• Modify displayed application content without authorization.
• Potentially obtain authentication information from other legitimate users.

This issue stems from insufficient encoding of OUTPUT parameters, leading to Cross-Site Scripting (XSS) vulnerabilities in the following ITS services: SPS1D, SPS2D, SR63D, SRGEN, SR00, SRPH, SR_LIBRARY, SR61, SR62, SRK1, SRK2, SRK3, SOR1, SH01, SH02, SR01, SR12, SR12_START, SR31, SR71_ERP, SR41, SR42.

Solution

To mitigate this vulnerability, apply SAP Note 1674219 or import the necessary changes via the relevant support package. Ensure that the corrections from SAP Notes 1621946 and 1488500 are also implemented, as they provide essential foundational fixes required for this correction to be effective.

Reason and prerequisites

• Steal authentication information, such as session data.
• Impersonate users, potentially with administrative privileges, compromising application security.

References

• SAP Note 1621946 – ITS: Updated XSS-Escaping Functions
• SAP Note 1488500 – ITS: Automatically Escape Context Fields in Output

Affected components

• SAP_APPL 600
• SAP_APPL 602
• SAP_APPL 603
• SAP_APPL 604
• SAP_APPL 605
• SAP_APPL 606