SAP security note 2114268, "Unauthorized modification of displayed content in BW-BEX-ET-WJR". Below are the symptom and SAP recommended solution.
Description
Symptom
BW-BEX-ET-WJR can be abused by an attacker, allowing them to modify displayed application content without authorization, and to potentially obtain authentication information from other legitimate users.
Solution
Please install the Java Patch specified by this Note. This correction is valid for BI Java 7.01, 7.30, 7.31 & 7.40.
The solution will be released in:
- 7.01 SP16 PL40 (as per SAP Note 2061891)
- 7.30 SP12 PL40
- 7.31 SP14 PL20
- 7.40 SP09 PL20 (as per SAP Note 1918317)
Reason and prerequisites
Pages within BW-BEX-ET-WJR do not sufficiently encode output parameters while throwing an exception, which can result in a reflected cross-site scripting issue. A reflected cross-site scripting attack can be used to non-permanently deface or modify displayed content from a website.
Reflected cross-site scripting can be used to steal another user’s authentication information, such as data relating to their current session. An attacker who gains access to this data may use it to impersonate the user and access all information with the same rights as the target user. If an administrator is impersonated, the security of the application may be fully compromised.
CVSS
Score 4.3 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
References
- SAP Note 2061891 – NW 7.01 SPS16 Patch 40 and SPS17 Patch 10, and NW 7.02 SPS16 Patch 40 and SPS17 Patch 10 for BI Java
- SAP Note 1918317 – BICS v27 for NW 7.30+, Design Studio, Analysis Office & BI Platform
Full note on SAP: SAP Support Launchpad note 2114268
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
