SAP Web Application Server Input Validation Hole in webgui Permits Cross-Site Scripting Attacks
|
|
SecurityTracker Alert ID: 1020097
|
|
SecurityTracker URL: http://securitytracker.com/id?1020097
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: May 22 2008
|
Impact: Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information
|
Fix Available: Yes
Exploit Included: Yes
Vendor Confirmed: Yes
|
Version(s): 7.0
|
Description: A vulnerability was reported in SAP Web Application Server. A remote user can conduct cross-site scripting attacks.
The '/sap/bc/gui/sap/its/webgui/' script does not properly filter HTML code from user-supplied input before displaying the input.
A remote user can create a specially crafted URL that, when loaded by a target user, will cause arbitrary scripting code to be
executed by the target user's browser. The code will originate from the site running the SAP Web Application Server software and
will run in the security context of that site. As a result, the code will be able to access the target user's cookies (including
authentication cookies), if any, associated with the site, access data recently submitted by the target user via web form to the
site, or take actions on the site acting as the target user.
A demonstration exploit URL is provided:
http://[target]:8000/sap/bc/gui/sap/its/webgui/aaaaaaa"><img/s
rc=javascript:alert('DSECRG_XSS')>
Web Dynpro ABAP and BSP are also affected.
Digital Security Research Group reported this
vulnerability.
|
Impact: A remote user can access the target user's cookies (including authentication cookies), if any, associated with the site running the
SAP Web Application Server software, access data recently submitted by the target user via web form to the site, or take actions
on the site acting as the target user.
|
Solution: The vendor has issued a fix. For Web Dynpro ABAP and for BSP, patches are available via SAP note 1136770.
|
Vendor URL: www.sap.com/ (Links to External Site)
|
Cause: Input validation error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
Reported By: Digital Security Research Group <research@dsec.ru>
|
Message History:
None.
|
Source Message Contents
|
Date: Wed, 21 May 2008 12:13:55 +0400
From: Digital Security Research Group <research@dsec.ru>
Subject: [DSECRG-08-023] SAP Web Application Server XSS Security Vulnerability
|
Digital Security Research Group [DSecRG] Advisory #DSECRG-08-023
Application: SAP Web Application Server
Versions Affected: Version 7.0
Vendor URL: http://SAP.com
Bugs: XSS
Exploits: YES
Reported: 25.01.2008
Vendor response: 25.01.2008
Date of Public Advisory: 21.05.2008
Author: Digital Security Research Group [DSecRG] (research [at] dsec [dot] ru)
Description
***********
SAP Web Application Server system has Linked XSS security vulnerability
Details
*******
Linked XSS vulnerability found in URL /sap/bc/gui/sap/its/webgui/ attacker can inject XSS in URL stri
ng
also Web Dynpro ABAP and for BSP are vulnerable.
Example:
http://[server]:8000/sap/bc/gui/sap/its/webgui/aaaaaaa"><img/src=javascript:alert('DSECRG_
XSS')>
---------------------------------------------------------------------
Fix Information
***************
The issue has been solved in the ICF system login and as such it is not only relevant for the Web GUI
, but also for Web Dynpro
ABAP and for BSP
Customers can download patches following the solution is documented in SAP note 1136770
About
*****
Digital Security is leading IT security company in Russia, providing information security consulting,
audit and penetration
testing services, risk analysis and ISMS-related services and certification for ISO/IEC 27001:2005 an
d PCI DSS standards.
Digital Security Research Group focuses on web application and database security problems with vulner
ability reports, advisories
and whitepapers posted regularly on our website.
Contact: research [at] dsec [dot] ru
http://www.dsec.ru
|
|
