Unauthorized usage and modification of SAP Retail Store, SAP security note 1437902

SAP security note 1437902, “Unauthorized usage and modification of SAP Retail Store”. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

The following 3 issues are possible:

1. The SAP Retail Store can be abused by a malicious user allowing them to modify displayed application content without authorization and to potentially obtain authentication information from other legitimate users.

2. The SAP Retail Store can be abused by a malicious user allowing them to modify application content, and persist the modified content without authorization and to potentially obtain authentication information from other legitimate users.

3. A malicious user can trigger functionality in SAP Retail Store without authentication and authorization.

Solution

The correction can be done with support package or note assistant.

Refer to notes 1481392 and 1488500 for additional information and instructions. The corrections from note 1481392 and 1488500 are a prerequisite for implementation of this note. If you use theme 99, you should also refer to note 1510419.

Implement the correction instructions of this note. Up to release 604 this will also create the report ITS_XSRF_XSS_PARAM_SRS in your system. Execute the report ITS_XSRF_XSS_PARAM_SRS and specify a corresponding transport request number when requested. The report will add service parameters for the adapted ITS services (maintained via the GUI configuration pushbutton for a service with transaction SICF).

Add the following parameter in the GUI Configuration of the external aliases (see also note 1107663):

~XSRFCHECK 1

Ensure that the Internet service system is published to site Integrated ITS to make sure that the JavaScript file sep_secu.js is accessible.

Reason and prerequisites

1. Several pages within the SAP Retail Store do not sufficiently encode output parameters, resulting in a reflected cross site scripting issue. A reflected cross site scripting attack can be used to non-permanently deface or modify displayed content from a web site. Reflected cross site scripting can be used to steal another user’s authentication information such as data relating to their current session. An attacker who gains access to this data may use this to impersonate the user and access all information with the same rights as the target user. In case of an administrator being impersonated, a full compromise of the application’s security can occur.

2. Some pages within the SAP Retail Store result in a stored cross site scripting issue. It can be used to permanently modify displayed content from a web site, allowing the malicious user to embed content that is rendered automatically, without the need to individually target victims. Stored cross site scripting can also be used to steal another user’s authentication information such as data relating to their current session. An attacker who gains access to this data may use this to impersonate the user and access all information with the same rights as the target user. In case of an administrator being impersonated, a full compromise of the application’s security can occur.

3. SAP Retail Store executes certain functions through referencing specific URLs. When an attacker tricks an authenticated user’s browser into making a request containing a certain URL and specific parameters, the function is executed with the rights of the user. If present, the attacker may use a Cross Site Scripting attack to trigger the exploit, or use an approach in which a link to click is presented to the victim.

References

• 1524777 – Unauthorized modification of content in SAP Retail Store
• 1510419 – IAC Template Library fixed for automatic HTML escaping
• 1501768 – ITS: Config. permitted or prohibited OK codes during start
• 1488500 – ITS: automatically escape context fields in output
• 1481392 – Cross Site Request Forgery Protection for ITS
• 1107663 – SRS/MEN: Problems reporting with integrated ITS

Affected components

• EA-RETAIL 500
• EA-RETAIL 600
• EA-RETAIL 602
• EA-RETAIL 603
• EA-RETAIL 604
• EA-RETAIL 605