SAP security note 1830630, "Unauthorized modification in BSP application in IS-HER-CM". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
IS-HER-CM can be exploited by a malicious user to modify displayed application content without authorization. This vulnerability may allow attackers to obtain authentication information from other legitimate users.
- Cross-Site Scripting (XSS): The vulnerability arises because BSP Pages DEFAULT.HTM within IS-HER-CM do not adequately encode OUTPUT parameters.
- Data Theft: Attackers can steal authentication details, such as session data, enabling them to impersonate users.
- Security Compromise: If an administrator’s credentials are compromised, the entire application’s security may be breached.
Solution
Apply SAP Note 1830630 or import the necessary changes via the relevant support package. This correction includes switching the HTMLB design for the following applications:
- PIQ_DEMOMODBOOK
- PIQ_DEMOTT
Affected components
- IS-HER-CM (Student Lifecycle Management) – versions 472, 600, 602, 603, 604, 605, 606, 616, 617
Full note on SAP: SAP Support Launchpad note 1830630
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].