SAP Security Note
High priority
SAP security note 1664632, “Unauthorized modification of ITS in QM”, is a program error note released on 08.05.2012. Below are the symptom and SAP recommended solution.
Description
Symptom
The Application Component QM is vulnerable to abuse by malicious users, allowing unauthorized modification of displayed application content and potential access to authentication information from other legitimate users.
Solution
Apply this SAP Note or import the changes via the relevant support package.
Important: The corrections in this note only provide protection if the corrections in SAP Notes 1621946 and 1488500 are also implemented.
Reason and prerequisites
ITS Services (including QISR, QISRW, TS_TS20000780H, QMW1, QC40, QC40A, QC42, QEW01) within the Application Component QM do not sufficiently encode OUTPUT parameters. This results in a cross-site scripting (XSS) vulnerability.
Cross-site scripting can be exploited to steal another user’s authentication information, such as session data. A malicious user with access to this data may impersonate the user and access information with the same privileges as the target user. If an administrator is impersonated, the security of the entire application may be compromised.
References
- SAP Note 1621946 – ITS: updated XSS-escaping functions
- SAP Note 1488500 – ITS: automatically escape context fields in output
Full note on SAP: SAP Support Launchpad note 1664632
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
