SAP security note 1610237, "Unauthorized Modification of Displayed Content in BW-CRM", is a program error note released on 18.10.2012. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
The CRM planning in BW can be abused to:
- Modify displayed application content without authorization.
- Steal authentication information from other users.
- Impersonate users, including administrators, potentially compromising the entire application's security.
Solution
To remediate this vulnerability, import the appropriate Support Package for your SAP NetWeaver BW version.
In urgent cases, you can apply the correction instructions. Ensure you review SAP Note 875986 for guidance on using transaction SNOTE before proceeding.
Reason and prerequisites
The vulnerability arises because pages within the CRM planning component in BW do not sufficiently encode OUTPUT parameters. This results in a reflected Cross-Site Scripting (XSS) issue, which can be exploited to:
- Deface or modify content displayed on the website.
- Steal user authentication information, such as session data, allowing attackers to impersonate users.
References
- Related SAP Note 1772647 – Update 1 to Security Note 1610237
- Side Effects: Navigation issues with sales planning application (SAP Note 1748982)
Affected components
- SAP NetWeaver BW 7.00
- SAP NetWeaver BW 7.01
- SAP NetWeaver BW 7.02
- SAP NetWeaver BW 7.11
- SAP NetWeaver BW 7.30
- SAP NetWeaver BW 7.31
Full note on SAP: SAP Support Launchpad note 1610237
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].