SAP security note 1659015, "URL in Launchpad-Navigation can be malformed", is a note. Below are the symptom and SAP recommended solution.
Description
Symptom
The URL of a launchpad navigation target can be exploited for cross-site scripting (XSS). The navigation parameters in the URL are not sufficiently encoded, resulting in a reflected XSS vulnerability.
Cross-site scripting (XSS) is a type of security vulnerability typically found in web applications. It allows malicious attackers to inject client-side scripts into web pages viewed by other users, potentially bypassing access controls and leading to significant security risks depending on the sensitivity of the data and the mitigations in place.
Solution
The issue has been addressed by validating the URL of the launchpad target navigation against cross-site scripting attacks. To resolve this vulnerability, apply the provided correction instructions or install the relevant support package.
Reason and prerequisites
The URL can be manipulated without any validation, allowing the execution of unauthorized scripts.
References
This note refers to
Full note on SAP: SAP Support Launchpad note 1659015
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
