Unauthorized modification of displayed content in BC-FES-CTL, SAP security note 1600429

SAP security note 1600429, “Unauthorized modification of displayed content in BC-FES-CTL”, is released on December 13, 2011. Below are the symptom and SAP recommended solution.

Description

Symptom

An attacker can exploit BC-FES-CTL to modify displayed application content without authorization. This vulnerability allows the potential theft of authentication information from legitimate users, enabling impersonation and unauthorized access.

Solution

SAP has introduced a new filtering mechanism in the HTML Control to mitigate this vulnerability. To resolve the issue:

• Implement Correction Instructions: follow the detailed correction instructions provided in the SAP Security Note.
• Enable Filtering: ensure that the NEEDFILTERING parameter is set when calling load_data or load_html_document methods. This allows the HTML Control to filter malicious content automatically before rendering.