SAP Note 1594641
SAP security note 1594641, "Unauthorized modification of displayed content in AS-ABAP", is a note. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
A vulnerability in the ABAP application server (AS-ABAP) allows malicious users to modify displayed application content without proper authorization. This can lead to the theft of authentication information from legitimate users, enabling impersonation and unauthorized access to sensitive data.
Solution
- Set profile parameter: add abap/http/whitelist_strict_check = X to your profile parameters.
- Review and update HTTP_WHITELIST rules: ensure that any rules specifying ‘protocol’, ‘host’, or ‘port’ require URLs to include both protocol and host. For example, update rules to enforce URLs like https://www.sap.com/sap/public/ping instead of allowing /sap/public/ping.
WarningThese manual steps must be performed individually on each system after importing the note.
References
Affected components
- SAP_BASIS 620 to 731
Full note on SAP: SAP Support Launchpad note 1594641
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].