Unauthorized modification of stored content in Data Provider, SAP security note 1744879

SAP security note 1744879, “Unauthorized modification of stored content in Data Provider”. Below are the symptom and SAP recommended solution.

Description

Symptom

The SAP GUI Data Provider can be abused by an attacker, allowing them to modify application content, persist the modified content without authorization, and potentially obtain authentication information from other legitimate users.

Solution

Implement the corrections outlined in this note or import the relevant support package. The SAP GUI Data Provider will scan documents and block all specified MIME types. Custom applications that utilize SAP GUI Data Provider functions or function modules directly might be affected, so it’s crucial to review the documentation to prevent potential disruptions.

Reason and prerequisites

SAP GUI Data Provider results in a stored cross-site scripting (XSS) issue. This vulnerability allows attackers to permanently modify displayed content on a website, embedding malicious content that is rendered automatically without targeting victims individually. Stored XSS can be exploited to steal users’ authentication information, such as session data. If an administrator’s credentials are compromised, the entire application’s security may be at risk.

References

• SAP Note 1779433 – SAP GUI: Virus scan is enabled during file upload
• SAP Note 1753745 – Virus scan profile: Enhancement for SAP KW