Unauthorized modification of stored content in CA-GTF-RCM, SAP security note 1609552

SAP security note 1609552, “Unauthorized modification of stored content in CA-GTF-RCM”, is a program error note released on 12.03.2012. Below are the symptom and SAP recommended solution.

Description

Symptom

CA-GTF-RCM can be abused by a malicious user, allowing them to modify application content, persist the modified content without authorization, and potentially obtain authentication information from other legitimate users.

Solution

Prerequisite: ensure that corrections from SAP Note 1582870 – ABAP XSS Escaping Support are applied before implementing this note.

Apply this note (1609552). BSP pages affected:

• RMPSPB_CASE: CASE.HTM, ERROR.HTM, NO_BSP_IMP.HTM, PROCESS.HTM
• RMPSPB_CASENOTE: ERROR.HTM, NOTES.HTM, VALIDATE.JS
• SRMPS_BROWSER: RECORDSBROWSER.HTM
• SRMPS_HISTORY: ERROR.HTM, HISTORY.HTM
• SRMPS_METADATA: CHANGEMETADATA.HTM, ERROR.HTM, INITIAL.HTM, METADATA.HTM, UPDATED.HTM
• SRMPS_SEARCH: ERROR.HTM, RESULTS1.HTM, SEARCH.HTM

Steps to correct:

• Execute transaction SE80.
• Select ‘BSP Application’ from the dropdown and enter the BSP application name (e.g., RMPSPB_CASE), then press Enter.
• Select the application node and click on ‘Expand All’ to view the application tree structure.
• Navigate to the ‘Views’, ‘Pages with flow logic’, or ‘Page fragments’ folder to find the BSP pages.
• Double-click the page to be changed and use the ‘Display/Change’ button to enter change mode.
• Go to the ‘Layout’ tab and replace the first statement: <%@page language="abap"%> with: <%@page language="abap" forceEncode="html"%>
• Save and activate the page.

Reason and prerequisites

Some BSP pages of CA-GTF-RCM result in a stored cross-site scripting issue. This vulnerability can be exploited to:

• Permanently modify displayed content from a website.
• Embed content that is rendered automatically without targeting victims individually.
• Steal another user’s authentication information, such as session data.
• Impersonate users, including administrators, potentially compromising the security of the application.

References

• 1700532 – Unauthorized modification of displayed content in CA-GTF-RCM
• 1582870 – ABAP XSS Escaping Support