Skip links
Arpine Maghakyan

Arpine Maghakyan

Security Researcher of RedRays.

Security Issues in SAML 1.1 Browser/Artifact Profile, SAP security note 1541765

Description

The web applications “SAML SSO Demo Application” and “SAML SSO Application” of the “SAML 1.1 Browser/Artifact Protocol” implementation in the AS Java have several security weaknesses that are addressed by this note.

1. Unauthorized modification of displayed content in the SAML SSO Demo Application

The SAML SSO Demo Application can be abused by a malicious user, allowing them to modify displayed application content without authorization, and to potentially obtain authentication information from other legitimate users.

2. Unauthorized use of application functions in the SAML SSO Demo Application

A malicious user can execute functions in the SAML SSO Demo Application without authentication and authorization.

3. Escalation of privileges in the SAML SSO Demo Application

An authenticated user can use functions of the SAML SSO Demo Application to gain access to other applications under another user’s rights.

4. Potential false redirection of Web site content in the SAML SSO Application

The SAML SSO Application can be used for phishing attacks by allowing a malicious user to publish a URL purporting to be from the product, which redirects the victim to a URL chosen by the malicious user. This enables a malicious user to falsely gain the trust of a victim and elicit private data from them (such as authentication information).

Available fix and Supported packages

  • SAP-JEE | 6.40 | 6.40
  • SAP-JEE | 7.00 | 7.02
  • SAP_JTECHS | 6.40 | 6.40
  • SAP_JTECHS | 7.00 | 7.02
  • SAP-JEECOR | 7.00 | 7.00
  • SAP-JEECOR | 6.40 | 6.40
  • SAP-JEECOR | 7.01 | 7.02
  • SERVERCORE | 7.10 | 7.10
  • SERVERCORE | 7.11 | 7.11
  • SERVERCORE | 7.20 | 7.20
  • SERVERCORE | 7.30 | 7.30
  • J2EE-APPS | 7.10 | 7.11
  • J2EE-APPS | 7.20 | 7.20
  • J2EE-APPS | 7.30 | 7.30
  • J2EE ENGINE APPLICATIONS 7.10 | SP009 | 000001
  • J2EE ENGINE APPLICATIONS 7.10 | SP010 | 000004
  • J2EE ENGINE APPLICATIONS 7.10 | SP011 | 000001
  • J2EE ENGINE APPLICATIONS 7.10 | SP012 | 000001
  • J2EE ENGINE APPLICATIONS 7.10 | SP013 | 000000
  • J2EE ENGINE APPLICATIONS 7.11 | SP003 | 000013
  • J2EE ENGINE APPLICATIONS 7.11 | SP004 | 000011
  • J2EE ENGINE APPLICATIONS 7.11 | SP005 | 000010
  • J2EE ENGINE APPLICATIONS 7.11 | SP006 | 000004
  • J2EE ENGINE APPLICATIONS 7.11 | SP007 | 000001
  • J2EE ENGINE APPLICATIONS 7.11 | SP008 | 000000
  • J2EE ENGINE APPLICATIONS 7.20 | SP001 | 000007
  • J2EE ENGINE APPLICATIONS 7.20 | SP002 | 000008
  • J2EE ENGINE APPLICATIONS 7.20 | SP003 | 000007
  • J2EE ENGINE APPLICATIONS 7.20 | SP004 | 000003
  • J2EE ENGINE APPLICATIONS 7.30 | SP001 | 000001
  • J2EE ENGINE APPLICATIONS 7.30 | SP002 | 000001
  • J2EE ENGINE SERVERCORE 7.10 | SP009 | 000023
  • J2EE ENGINE SERVERCORE 7.10 | SP010 | 000019
  • J2EE ENGINE SERVERCORE 7.10 | SP011 | 000003

Affected component

    BC-JAS-SEC
    Security, User Management

CVSS

Score: 0

Exploit

Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.

URL

https://launchpad.support.sap.com/#/notes/1541765

TAGS

#Reflected-cross-site-scripting
#XSS
#Cross-site-request-forgery
#XSRF
#privilege-escalation
#Cross-domain-redirection.SAML-SSO-Demo-Application
#SAML-SSO-Application.

More to explorer

SAP Cloud Connector Certificate Validation Issue

Date of Release: February 13, 2024 Advisory ID: CVE-2024-25642 Affected Software: SAP Cloud Connector Versions Affected: 2.15.0 to 2.16.1 Vulnerability Summary:A critical vulnerability,