Unauthorized modification of displayed content in UI_INFRA and SAP_UI, SAP security note 2010819

SAP security note 2010819, "Unauthorized modification of displayed content in UI_INFRA and SAP_UI", is a note released on 11.11.2014. Below are the symptom and SAP recommended solution.

Description

Symptom

UI_INFRA and SAP_UI can be abused by an attacker, allowing them to modify displayed application content without authorization, and to potentially obtain authentication information from other legitimate users.

Solution

Apply support package SP09 of the SAP UI Add-On 1.0 or SAP_UI SP09 of SAP NetWeaver Web Application Server 7.40.

Reason and prerequisites

Pages within UI_INFRA and SAP_UI do not sufficiently encode OUTPUT parameters, resulting in a reflected cross-site scripting issue. A reflected cross-site scripting attack can be used to non-permanently deface or modify displayed content from a website. This can also be used to steal another user’s authentication information, potentially allowing an attacker to impersonate the user.

CVSS

Score 4.3 Vector: AV:N/AC:M/AU:N/C:N/I:P/A:N

References

• 1937147 – SAPUI5 Application Http Handler: Caching of Start Pages, IE Compatibility Setting