SAP Note 1372831
SAP security note 1372831, "WS Navigator help page can be misused for XSS", is a note. Below are the symptom and SAP recommended solution.
Description
Symptom
The Web Services Navigator help page can be misused for cross-site scripting (XSS).
Solution
The XSS security issue is fixed in the following releases:
- SAP NetWeaver 2004 SPS 23
- SAP NetWeaver 7.0 SPS 14
- SAP NetWeaver 7.0 including Enhancement Package 1 SPS 0
- SAP NetWeaver 7.0 including Enhancement Package 2 SPS 0
The JavaScript code will still be displayed on the page but won’t be executed.
In the following releases, the XSS problem is fully fixed and the parameters are not displayed anymore:
- SAP NetWeaver 2004 SPS 24 – find attached a fixed SDA
- SAP NetWeaver 2004 SPS 25
- SAP NetWeaver 7.0 SPS 19 Patch Level 3
- SAP NetWeaver 7.0 including Enhancement Package 1 SPS 6
- SAP NetWeaver 7.0 including Enhancement Package 2 SPS 2
Reason and prerequisites
WS Navigator displays the passed parameter as a title of the page.
References
This note refers to
Full note on SAP: SAP Support Launchpad note 1372831
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].