XSS Hardening of attachment downoload, SAP security note 1866659

SAP security note 1866659, "XSS Hardening of attachment download", is a modification note released on 13.08.2013. Below are the symptom and SAP recommended solution.

Description

Symptom

In the "common" module, the functionality of downloading or opening an attached file can be exploited by an attacker, allowing the attacker to modify application content, persist the modified content without authorization, and potentially obtain authentication information from other legitimate users.

Solution

Implement the latest patch from the service marketplace.

Reason and prerequisites

The Web Channel Experience Management (WCEM) application must be installed and properly configured. The "common" module must be active, and the functionality for downloading or opening attached files must be in use. Downloading an attached file may result in a stored or persistent cross-site scripting (XSS) issue.

This vulnerability can be exploited to permanently modify displayed content on a website, allowing the attacker to embed content that is rendered automatically without needing to target victims individually. Stored XSS can also be used to steal another user’s authentication information, such as data related to their current session. An attacker who gains access to this data may impersonate the user and access all information with the same rights as the target user. If an administrator is impersonated, the security of the application may be fully compromised.