SAP security note 1692352, "Unauthorized modification of the content in CRM-MD-BP-CCP", is a program error note released on 08.05.2012. Below are the symptom, SAP recommended solution and affected software components.
Description
Symptom
The application component CRM-MD-BP-CCP can be abused by an attacker, allowing unauthorized modification of the displayed application and potential retrieval of authentication information from other legitimate users. This vulnerability arises because the objects of the function group CRM_CCKPT_CFS_SERVICE use the old XSS encoding library. All calls to the methods of the old XSS library must be replaced with calls to the new XSS library.
Solution
Implement this SAP Note or import the necessary changes via the relevant support package.
Reason and prerequisites
The class CL_HTTP_UTILITY within the application component CRM-MD-BP-CCP does not sufficiently encode OUTPUT parameters, resulting in a cross-site scripting issue. An attacker can exploit this to steal another user's authentication information, such as data relating to their current session. This stolen data can be used to impersonate the user and access information with the same privileges. If an administrator is impersonated, the security of the application may be fully compromised.
Affected components
- BBPCRM: Versions 500, 520, 600, 700, 701, 702, 712
Full note on SAP: SAP Support Launchpad note 1692352
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].