High priority
SAP security note 1559060, “Unauthorized modification of displayed content,” is a note released on July 12, 2011. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An HTTP request for an inactive or unavailable HTTP service can be exploited by a malicious user to obtain authentication information from other legitimate users.
Solution
To mitigate this vulnerability, you should:
- Import the relevant Support Package for your SAP_BASIS version. Support packages are available here (replace the URL with the appropriate link based on your version).
- Implement the correction instructions provided in the note. Detailed correction instructions can be found here.
Reason and prerequisites
The error page handling in the ICF runtime does not sufficiently encode output parameters, resulting in a reflected cross-site scripting issue. This vulnerability can be used to non-permanently deface or modify displayed content on a website, and to steal another user’s authentication information, such as session data. If an administrator’s credentials are compromised, the entire application’s security may be at risk.
Affected components
- SAP_BASIS 6.40
- SAP_BASIS 7.00 to 7.02
- SAP_BASIS 7.10 to 7.11
- SAP_BASIS 7.20 to 7.30
Full note on SAP: SAP Support Launchpad note 1559060
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
