Skip links
RedRays - Your SAP Security Solution
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

SAP Security on Udemy

XSS attacks protection, SAP security note 1175239

SAP Note 1175239

SAP security note 1175239, "XSS Attacks Protection". Below are the symptom and SAP recommended solution.

Description

Symptom

Security issues were detected in the authentication mechanism, specifically:

  • Lack of encryption for HTTP parameters used during navigation post-authentication, making it susceptible to URL manipulation.
  • Insufficient escaping and validation of special scripting characters in all inputs of the logon application.
  • Unescaped values in hidden input fields, risking the integrity of initial POST parameters.

Solution

  • For Release 7.11: Download and deploy the latest J2EEAPPS.SCA patch for your current Support Package (SP).
  • For Release 7.10: If on SP6, the patch is already available. For SP5, apply the latest patches for the SERVERCORE and ENGINEAPI components available on the SAP Support Marketplace.
  • For Releases 6.40, 7.00, 7.01, 7.02, 7.20, 7.21, and 7.22: Escape and validate inputs is already implemented in the logon application, no additional fixes required. URL encryption is available in specific SPs: 6.40 SP26, 7.00 SP22, 7.01 SP07, 7.02 SP03. For older SPs released in the last 18 months, apply the latest patches for SAP_JTECHS and SAP-JEECOR from the SAP Support Marketplace.
WarningEnsure that both components (SAP_JTECHS.sca and SAP-JEECOR) are patched together to avoid issues such as: 1. Redirection to index.html post-login. 2. NoSuchMethodError or NoClassDefFoundError exceptions. 3. "404 Not Found" errors with scrambled URL sequences. Deploy the latest patch levels for both components as mentioned to resolve these issues.

References

Full note on SAP: SAP Support Launchpad note 1175239

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#XSS#Cross-Site Scripting#Authentication#Logon Application

Explore More