Update #1 to Security Note 866020, SAP security note 1601461

SAP security note 1601461, “Update #1 to Security Note 866020.” Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

User inputs in Internet applications might execute unintended external source code (e.g., JavaScript) if not properly encoded. This can lead to XSS vulnerabilities.

Solution

To mitigate XSS risks, all external user inputs or content from external sources should be encoded before being displayed in a web browser. The updated XSS encoding methods are as follows:

• ABAP (refer to SAP Note 1582870): use the class CL_ABAP_DYN_PRG which contains the XSS encoding methods.
• C/C++ (refer to SAP Note 1582867): internal SAP functions are available for XSS encoding.
• JAVA (refer to SAP Note 1590008): utilize the J2EE/JEE security library class tc_sec_csi.jar for encoding.

Ensure that your SAP system is updated with the relevant support packages as mentioned in the notes above.

Reason and prerequisites

Direct display of user inputs without proper encoding can allow the execution of malicious code in web applications. Implementation of encoding methods as described in SAP Note 866020 is a prerequisite.

References

• Cross Site Scripting Prevention Library (1714836)
• JAVA Output Encoding (1590008)
• ABAP XSS Escaping Support (1582870)
• Security Options (XSS) for ESCAPE (1582867)
• SAP Encoding Functions in the Web Environment (866020)

Affected components

• SAP_BASIS 620 to 640
• SAP_BASIS 700 to 702
• SAP_BASIS 710 to 730
• SAP_BASIS 731