SAP Security Note
Low priority
SAP security note 889454, “XSS attacks via ~designbaseurl”, is a program error note released on 08.10.2009. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
When you start a service, the message “Security exploit” appears. In the trace, you can then find entries such as:
illegal host in ~designbaseurl=.......WorkXSSFilter: possible xss exploit
Solution
Both the integrated ITS and the external ITS contain checks to avert possible cross-site scripting attacks. A possible attack could entail infiltration of a CSS file from an external host (in this case, a cascading style sheet) via the parameter ~designbaseurl. To prevent this, the ITS, by default, allows only the current host on which the integrated or external ITS is running to be specified in ~designbaseurl. To extend this to a complete domain, proceed as follows:
- For the external ITS: In the
Security/AllowDesignsFromkey in the registry, enter a list of permitted hosts or domains separated by commas, for example:<key name="Security"><value name="AllowDesignsFrom" type="text">myhost,.company.com</value></key> - For the integrated ITS: Set the parameter in the profile file as follows, for example:
itsp/Security/allow_designs_from = myhost,.company.com. Enter the parameter blank in the local profile file to avoid possible error messages due to a parameter not being set. The error message does not occur and the system does not perform a check.
Reason and prerequisites
An insecure parameter has been specified for ~designbaseurl using the URL or service definition.
Affected components
- BC-FES-ITS: Versions 620 to 630+
- SAP_BASIS: Versions 640 to 640, 700 to 701, 710 to 710
Full note on SAP: SAP Support Launchpad note 889454
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
