Unauthorized modification of displayed content in WEBCUIF, SAP security note 1577766

SAP security note 1577766, "Unauthorized modification of displayed content in WEBCUIF", is a note. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

WEBCUIF can be abused by an attacker, allowing them to modify displayed application content without authorization, and to potentially obtain authentication information from other legitimate users.

Solution

Implement the manual steps and the attached correction instructions or install the corresponding support package.

• Log on to your CRM SYSTEM through SAP GUI.
• Launch transaction SE80.
• In the object navigator on the left, select "BSP Extension" from the "Application Hierarchy" dropdown.
• Type THTMLBX and press Enter.
• Double-click on btf.
• In the main work area, select the "Attributes" tab.
• Insert a new Attribute with the following information: Attribute: hideSourceView; Required: leave unchecked; Dynamic Value Allowed: CHECK; Call By Ref.: leave unchecked; Bindable: leave unchecked; Typing Method: 1 TYPE; Associated Type: STRING; Default Value: TRUE; Description: Hide the Source View button.
• Change the default value for filterDocumentContent from FALSE to TRUE.
• Save and activate using the activate button in the top toolbar.

Reason and prerequisites

The BTF Editor within WEBCUIF doesn’t sufficiently encode the content, resulting in a reflected cross-site scripting issue. An attacker can use this vulnerability to non-permanently deface or modify displayed content from a web site. Additionally, reflected XSS can be exploited to steal another user’s authentication information, such as data relating to their current session. This could allow an attacker to impersonate the user and access information with the same privileges. If an administrator is impersonated, the security of the application may be fully compromised.

References

• 1768871 – BTF Editor: convert css rgb color definition to hex format

Affected components

• CRMUIF: Versions 510, 520, 600
• WEBCUIF: Versions 700, 701, 730, 746