Unauthorized modification of stored content in EWS, SAP security note 1576708

SAP security note 1576708, “Unauthorized modification of stored content in EWS”, is a program error note released on October 11, 2011. Below are the symptom and SAP recommended solution.

Description

Symptom

EWS can be abused by a malicious user, allowing them to modify application content, persist the modified content without authorization, and potentially obtain authentication information from other legitimate users.

Solution

The fix is included in EWS 1.1 SP0.

Reason and prerequisites

A specific EWS operation results in a stored cross-site scripting issue. This vulnerability can be exploited to permanently modify displayed content, enabling malicious users to embed content that is rendered automatically without targeting victims individually. Additionally, stored cross-site scripting can be used to steal another user's authentication information, such as data related to their current session. If an administrator is impersonated, the security of the application may be fully compromised.