Unauthorized modification of displayed content in BSP, SAP security note 1422273

SAP security note 1422273, "Unauthorized modification of displayed content in BSP". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

The execution of a BSP application can be misused by a malicious user to obtain authentication information of other legitimate users.

Solution

Import the relevant Support Package or perform the following manual steps:

• Delete the class CL_BSP_ICF
  • Use transaction SE80.
  • Select “Class / Interface” and enter CL_BSP_ICF.
  • Enter edit mode by selecting Class → Display ↔ Edit.
  • Deactivate the Modification Assistant via Edit → Modification Operations → Switch Off Assistant if not already deactivated.
  • Delete the class from the context menu.
• Delete the BSP application ICF
  • Use transaction SE80.
  • Select “BSP Application” and enter ICF.
  • Delete the object ICF from the context menu and confirm.
• Delete the BSP application BSP_VERI
  • Use transaction SE80.
  • Select “BSP Application” and enter BSP_VERI.
  • Delete the object BSP_VERI from the context menu and confirm.
• Delete the ICF services
  • Use transaction SICF.
  • Delete the services /sap/bc/bsp/sap/bsp_veri and /sap/bc/bsp/sap/icf.

For more detailed instructions, refer to the Solution section of this note.

Reason and prerequisites

The vulnerability is due to the missing encoding of the input parameters. This results in possibilities of attack by cross-site scripting or by cross-domain redirection.

• Cross-site scripting can be used to steal authentication or session information, allowing an attacker to impersonate another user.
• Cross-domain redirection enables a malicious user to redirect to a page of their choice while appearing as a legitimate BSP application.

The relevant ICF service was deleted and cannot be removed via correction instructions. As a result, the services are no longer available from the specified Support Packages.

Affected components

• Internet Communication Framework