SAP Security Note
High priority
SAP security note 1606471, "Unauthorized modification of displayed content in workflow", released on 25.11.2011. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
The application content displayed by Business Server Page (BSP) applications of the Business Workflow can be abused by a malicious user. This allows unauthorized modification of displayed application content and the potential theft of authentication information from other legitimate users.
Solution
Implement the attached program corrections or import the relevant Support Package.
Reason and prerequisites
Pages within BSP applications do not sufficiently encode input and output parameters, resulting in a reflected cross-site scripting vulnerability. This can be exploited to deface or modify displayed content non-permanently and steal users’ authentication information. A malicious user can impersonate another user, potentially compromising the entire application’s security if an administrator’s credentials are targeted.
Affected components
- SAP_BASIS: from version 620 to 640, from version 700 to 702, from version 710 to 730, version 731
Full note on SAP: SAP Support Launchpad note 1606471
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].