Unauthorized modification of stored content in BC-SRV-KPR-CS, SAP security note 1767955

SAP security note 1767955, "Unauthorized modification of stored content in BC-SRV-KPR-CS", is a program error note released on 23.05.2014. Below are the symptom and SAP recommended solution.

Description

Symptom

The BC-SRV-KPR-CS can be abused by a malicious user allowing them to modify displayed application content without authorization and to potentially obtain authentication information from other legitimate users.

Solution

Please perform the following steps to disable the HTTP TRACE method in IIS and Apache respectively.

Disable HTTP TRACE in IIS:

• Use URLScan to block the HTTP TRACE verb.
• Modify the urlscan.ini file: set UseAllowVerbs=0 to ensure the DenyVerbs section is enforced; in the [DenyVerbs] section, add TRACE to deny the TRACE method.
• Restart IIS to apply the changes.

Disable HTTP TRACE in Apache:

• For Apache versions newer than 1.3.34 and 2.0.55 (or newer) for Apache2, add the following line to the httpd.conf file to disable the HTTP TRACE method: TraceEnable off
• Restart Apache to apply the changes.

Reason and prerequisites

BC-SRV-KPR-CS results in a Reflected cross-site scripting issue if the HTTP TRACE method is switched on. A reflected cross-site scripting attack can be used to non-permanently deface or modify displayed content from a website. Reflected cross-site scripting can be used to steal another user’s authentication information such as data relating to their current session. An attacker who gains access to this data may use this to impersonate the user and access all information with the same rights as the target user. In case of an administrator being impersonated, a full compromise of the application’s security may occur.

CVSS

Score 5.8 Vector: AV:N/AC:M/AU:N/C:P/I:P/A:N

References

• SAP Note 514500 – Importing patches for SAP Content Server 6.50