Unauthorized modification of displayed content in HTMLB, SAP security note 1555906

SAP security note 1555906, “Unauthorized modification of displayed content in HTMLB”. Below are the symptom and SAP recommended solution.

Description

Symptom

HTMLB can be abused by a malicious user, allowing them to modify displayed application content without authorization, and to potentially obtain authentication information from other legitimate users.

Solution

The issue described above will be fixed by an HTMLB for Java patch. In the “SP Patch Level” section, you can find information on which patches contain the respective correction.

• NW04S / NW 7.00 / NW04S Ehp1 / NW 7.01 / NW04S Ehp2 / NW 7.02: The patch for this release will be a SCA. Deploy the SCA directly using SDM. Recommendation for Portal Usage: if there is no software component for EPBC2 in the “SP Patch Level” tab, apply the latest relevant EPBC2 SCA available in the service marketplace. Recommendation for Portal Independent Usage: if there is no software component for SAPJTECHS in the “SP Patch Level” tab, apply the latest relevant SAPJTECHS.SCA available in the service marketplace.
• NW07 / NW 7.10 / NW07 Ehp1 / NW 7.11: The patch for this release will be a SCA. Deploy the SCA directly using SDM. Recommendation for Portal Usage: if there is no software component for EPBASIS in the “SP Patch Level” tab, apply the latest relevant EPBASIS.SCA available in the service marketplace. Recommendation for Portal Independent Usage: if there is no software component for FRAMEWORK in the “SP Patch Level” tab, apply the latest relevant FRAMEWORK.SCA available in the service marketplace. Many of the SDAs included in the SCA are offline deployments. The engine is restarted during deployment, and the time required depends on whether the engine has to be restarted and the applications installed on the engine.

Reason and prerequisites

HTMLB does not sufficiently encode input or output parameters, resulting in a reflected cross-site scripting issue. A reflected cross-site scripting attack can be used to non-permanently deface or modify displayed content from a website. It can also be used to steal another user’s authentication information, such as data relating to their current session. An attacker who gains access to this data may use it to impersonate the user and access all information with the same rights as the target user. If an administrator is impersonated, the security of the application may be fully compromised.