SAP Security Note
High priority
SAP security note 1648395, "Unauthorized modification of displayed content in CA-AUD", is a note released on 10.04.2012. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An attacker can abuse CA-AUD to modify displayed content without authorization and potentially obtain authentication information from other legitimate users.
Solution
To mitigate this vulnerability:
- Replace the HTTP Handler: replace CL_PLM_AUDIT_HTTP_PDF_VIEWER with a custom handler.
- Delete the outdated HTTP Handler: remove the outdated HTTP handler of SAP.
Manual activity: delete the class CL_PLM_AUDIT_HTTP_PDF_VIEWER within the class builder (SE24).
Reason and prerequisites
The API interface within CA-AUD does not sufficiently encode input parameters, resulting in a reflected XSS issue. This vulnerability can enable an attacker to:
- Deface or modify website content.
- Steal user authentication information.
- Impersonate users, including administrators, potentially compromising the entire application.
Affected components
- SAP_ABA: 700 to 702, 710 to 711, 731
Full note on SAP: SAP Support Launchpad note 1648395
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].