Unauthorized modification of stored content in ST, SAP security note 1560605

SAP security note 1560605, "Unauthorized modification of stored content in ST", is a program error note released on 10.05.2011. Below are the symptom and SAP recommended solution.

Description

Symptom

The “Solution Manager Implementation” (SV-SMG-IMP) module can be exploited by malicious users, allowing unauthorized modification of application content. This vulnerability permits persistent unauthorized changes and the potential extraction of authentication information from other legitimate users.

Solution

Implement this security note using the Note Assistant (transaction SNOTE):

• Open the SAP GUI.
• Enter transaction code SNOTE.
• Import and apply the note 1560605.

Reason and prerequisites

Pages within the “Solution Manager Implementation” do not adequately encode input parameters, leading to a reflected cross-site scripting vulnerability. This allows attackers to:

• Deface or modify displayed content on the website temporarily.
• Steal authentication information, such as session data, enabling impersonation of users.
• Gain unauthorized access with the same privileges as the compromised user, potentially compromising the security of the entire application if an administrator is targeted.

References

• SAP Solution Manager: Basic functions 7.1 SP1
• Automatic checks for security notes using RSECNOTE (outdated)