Unauthorized modification of content displayed in BW, SAP security note 1749777

SAP security note 1749777, "Unauthorized modification of content displayed in BW", is a program error note released on 11.09.2012. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

Business Warehouse can be abused by an attacker, allowing them to modify displayed application content without authorization, and to potentially obtain authentication information from other legitimate users.

Solution

SAP NetWeaver 7.0 BI Java

• Import Support Package 28 for SAP NetWeaver 7.0 BI Java into your BI system.
• In urgent cases, implement corrections by applying BI Java patches: apply BI Java Patch SP27 #10 (Support Package 27, Patch level 10) for SAP NetWeaver 7.0 BI Java.

SAP NetWeaver BI 7.01 (SAP NW BI 7.0 Enhancement Package 1)

• Import Support Package 13 for SAP NW BI 7.0 EhP 1 BI JAVA into your BI system.
• In urgent cases, implement corrections by applying BI Java patches: apply BI Java Patch SP011 #40 (Support Package 11, Patch level 40) for SAP Enhancement Package 1 for NetWeaver 7.0 (7.01) BI Java.

All SAP Notes mentioned in this SAP Note will be available when the corresponding Support Package or patch is released in SAP Service Marketplace. Refer to information note 1506722 for more details. It contains general information about BI Java patches and Support Packages.

Reason and prerequisites

Business Warehouse uses the unified rendering to display reports.

Rendering within unified rendering does not sufficiently encode HTML-OUTPUT parameters, resulting in a reflected cross-site scripting issue. A reflected cross-site scripting attack can be used to non-permanently deface or modify displayed content from a Web site. Reflected cross-site scripting can be used to steal another user’s authentication information, such as data relating to their current session. An attacker who gains access to this data may use it to impersonate the user and access all information with the same rights as the target user. If an administrator is impersonated, the security of the application may be fully compromised.

Due to SAP Note 1637338, changes were made to Business Warehouse in the build process. The solution proposed here ensures that the central and continuously updated library closes the security hole mentioned here.

References

• SAP Note 1724503 – SAPBINEWS NW7.01 BI JAVA SP13
• SAP Note 1724450 – SAPBINEWS NW7.0 BI JAVA SP28
• SAP Note 1710779 – Adjustments in build dependencies
• SAP Note 1709658 – EP Framework adjustment for usage of the central Java lib
• SAP Note 1706344 – NW7.0 SPS 27 Patch 10 note for BI Java
• SAP Note 1706292 – NW 7.01 SP 11 Patch Level (PL) 40 for BI Java
• SAP Note 1637338 – Unauthorized modification of displayed content in UR
• SAP Note 1615941 – Portal XSS Encoding Library – StringUtils
• SAP Note 1506722 – Generic Note for BI Java Patches and Support Packages
• SAP Note 1309000 – NW 7.01 and NW 7.02: BI Java Patch Delivery
• SAP Note 1055581 – Recommendations for Support Package Stacks for BI 7.0
• SAP Note 1033246 – NW 7.0 (NW04s): BI Java Synchronized Patch Delivery
• SAP Note 1011241 – Patches for NetWeaver 2004s BI Java Support Package

Affected components

• BI-BASE-S 7.00 – 7.02
• SAP_BW 700 – 702
• HM-BI-BASE-S 7.00 – 7.02
• HM-BIWEBAPP 7.00 – 7.02
• BIWEBAPP 7.00 – 7.02