{"id":23653,"date":"2024-10-30T09:40:46","date_gmt":"2024-10-30T08:40:46","guid":{"rendered":"https:\/\/herolab.usd.de\/security-advisories\/usd-2024-0004\/"},"modified":"2024-11-08T16:09:47","modified_gmt":"2024-11-08T15:09:47","slug":"usd-2024-0004","status":"publish","type":"page","link":"https:\/\/herolab.usd.de\/en\/security-advisories\/usd-2024-0004\/","title":{"rendered":"usd-2024-0004"},"content":{"rendered":"<p>[et_pb_section fb_built=\"1\" _builder_version=\"4.21.0\" _module_preset=\"default\" background_color=\"#2E353D\" custom_padding=\"||0px|||\" global_colors_info=\"{}\"][et_pb_row _builder_version=\"4.25.2\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_column type=\"4_4\" _builder_version=\"4.21.0\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_text _builder_version=\"4.27.0\" _module_preset=\"default\" custom_padding=\"||13px|||\" global_colors_info=\"{}\"]<\/p>\n<h1>usd-2024-0004 | Stored XSS in SAP Business Connector<\/h1>\n<h1><\/h1>\n<p><strong>Advisory ID<\/strong>: usd-2024-0004<br \/><strong>Product<\/strong>: SAP Business Connector<br \/><strong>Affected Version<\/strong>: 4.8.1 SR4 &amp; CF2<br \/><strong>Vulnerability Type<\/strong>: Improper Neutralization of Input During Web Page Generation (CWE-79 'Stored Cross-site Scripting')<br \/><strong>Security Risk<\/strong>: Medium CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:R\/S:C\/C:L\/I:L\/A:N<br \/><strong>Vendor URL<\/strong>: <a>https:\/\/support.sap.com\/en\/product\/connectors\/bc.html<\/a><br \/><strong>Vendor acknowledged vulnerability<\/strong>: Yes<br \/><strong>Vendor Status<\/strong>: Fixed<br \/><strong>CVE number<\/strong>: CVE-2024-30215<br \/><strong>CVE Link<\/strong>: <a>https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2024-30215<\/a><\/p>\n<h3>Description<\/h3>\n<p>SAP Business Connector is an application developed by SAP SE, a German software corporation specializing in enterprise software solutions.<\/p>\n<p>SAP Business Connector is an integration tool that allows businesses to connect various systems and applications, both within and outside the organization.<br \/>It enables seamless data exchange and interoperability between different systems, enabling businesses to automate processes, streamline operations, and improve productivity.<\/p>\n<p>The application provides a platform for integrating diverse systems, such as ERP (Enterprise Resource Planning) systems, databases, web services, and legacy systems.<br \/>It supports a wide range of communication protocols, including HTTP, FTP, SOAP, and XML.<\/p>\n<p>Version 4.8.1 with Patch SR4 and CF2 was found to be vulnerable to a stored XSS vulnerability in the \"User-Agent field\" of the \"Outbound HTTP Settings\".<\/p>\n<h3>Proof of Concept<\/h3>\n<p>Navigate to \"Settings\" &gt; \"Resources\" and hit \"Edit Resource Settings\".<br \/>Enter the payload <strong>\"&gt;&lt;img src=\/X onerror=alert(document.domain)&gt; <\/strong>into the \"User-Agent\" field of the \"Outbound HTTP Settings\".<\/p>\n<p>The payload is stored and reflected whenever a user visits the Resource Settings page:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/herolab.usd.de\/wp-content\/uploads\/sites\/9\/2024\/08\/2023-12-15-1702628101.png\" alt=\"\" class=\"wp-image-23208 alignnone size-full\" width=\"845\" height=\"407\" srcset=\"https:\/\/herolab.usd.de\/wp-content\/uploads\/sites\/9\/2024\/08\/2023-12-15-1702628101.png 845w, https:\/\/herolab.usd.de\/wp-content\/uploads\/sites\/9\/2024\/08\/2023-12-15-1702628101-480x231.png 480w\" sizes=\"(min-width: 0px) and (max-width: 480px) 480px, (min-width: 481px) 845px, 100vw\" \/><\/p>\n<h3>Fix<\/h3>\n<p>It is recommended to treat all input on the website as potentially dangerous.<br \/>Hence, all output that is dynamically generated based on user-controlled data should be encoded according to its context.<br \/>The majority of programming languages support standard procedures for encoding meta characters.<\/p>\n<h3>References<\/h3>\n<p><a>https:\/\/owasp.org\/www-community\/attacks\/xss\/<\/a><\/p>\n<h3>Timeline<\/h3>\n<ul>\n<li><strong>2023-12-15<\/strong>: Vulnerability identified by Ole Wagner and Christian Poeschl.<\/li>\n<li><strong>2024-01-08<\/strong>: Initial contact request via SAP's Vulnerability Disclosure Form.<\/li>\n<li><strong>2024-02-05<\/strong>: SAP confirmed that the finding is a valid vulnerability.<\/li>\n<li><strong>2024-03-26<\/strong>: Received status update stating that fixes for confirmed vulnerabilities are currently in development\/already released. Further information will be provided by SAP.<\/li>\n<li><strong>2024-04-09<\/strong>: Patch released as <a href=\"https:\/\/me.sap.com\/notes\/3421453\" target=\"_blank\" rel=\"noopener\">SAP Note 3421453.<\/a><\/li>\n<\/ul>\n<h3>Credits<\/h3>\n<p>This security vulnerability was found by Christian Poeschl and Ole Wagner of usd AG.<\/p>\n<p>[\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"<p>usd-2024-0004 | Stored XSS in SAP Business Connector Advisory ID: usd-2024-0004Product: SAP Business ConnectorAffected Version: 4.8.1 SR4 &amp; CF2Vulnerability Type: Improper Neutralization of Input During Web Page Generation (CWE-79 'Stored Cross-site Scripting')Security Risk: Medium CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:R\/S:C\/C:L\/I:L\/A:NVendor URL: https:\/\/support.sap.com\/en\/product\/connectors\/bc.htmlVendor acknowledged vulnerability: YesVendor Status: FixedCVE number: CVE-2024-30215CVE Link: https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2024-30215 Description SAP Business Connector is an application developed by [&hellip;]<\/p>\n","protected":false},"author":118,"featured_media":0,"parent":16124,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","inline_featured_image":false,"footnotes":""},"class_list":["post-23653","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/23653","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/users\/118"}],"replies":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/comments?post=23653"}],"version-history":[{"count":3,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/23653\/revisions"}],"predecessor-version":[{"id":23656,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/23653\/revisions\/23656"}],"up":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16124"}],"wp:attachment":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/media?parent=23653"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}