SAP security note 822881, "XSS Support for BSP-Extensions HTMLB, XHTMLB and PHTMLB", is released on 08.10.2009. Below are the symptom and SAP recommended solution.
Description
Symptom
XSS Support for BSP-Extensions HTMLB, XHTMLB and PHTMLB.
Solution
All BSP-Extensions that accept input parameters via HTTP requests, dynamically generate HTML based on these inputs, and return the content as a response to the client (browser) are potentially vulnerable to XSS attacks.
To protect the BSP-Extensions HTMLB, XHTMLB, and PHTMLB against XSS attacks, use the following attribute on the HTMLB content tag:
<htmlb:content forceEncode="ENABLED">
...
</htmlb:content>This protection is available in SAP_BASIS versions 620SP50, 640SP12, and 700. For SAP_BASIS 640SP11, you can apply this note manually.
Reason and prerequisites
This note provides information on whether the BSP-Extensions HTMLB, XHTMLB, and PHTMLB are vulnerable to Cross Site Scripting (XSS) attacks and how to protect these extensions against such attacks.
This note also documents a known side effect: 914891 – Tooltip for project objects is not displayed any longer.
CVSS
Score 0
References
This note refers to
- 1607299 – Unauthorized modification of displayed content in PI Demo
- 1565781 – Buyer: Sec. note for cross-site scripting & BSP applications
- 1411659 – Security fixes for SRM SUS, Vendor Evaluation, SRM ROS
- 1259414 – Cross Site Scripting: PCUI Stored JavaScript Vulnerability
- 920404 – Java script error due to '"' in project description
- 891232 – BSP Security Relevant Changes
- 887168 – BSP Page Directive <%@page forceEncode="html"%> & <%html=%>
- 782567 – Cross Site Scripting (XSS)
Full note on SAP: SAP Support Launchpad note 822881
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
