SAP HANA 4 Cross Site Scripting

`SAP Hana Cloud Platform Cockpit Cross site Scripting Vulnerabilities  
  
  
========================================================================  
Vender:   
SAP  
  
Product:   
SAP HANA CLoud  
  
Vulnerability Type:   
Cross site scripting  
  
Title:   
SAP Hana Cloud Cross scripting in User Display Name  
  
Details:   
SAP Hana cloud allows any user with the least privileges to input arbitrary client side JS code into the Display Name parameter. Victim intervention is not required for the successful as the code is stored and execute in the browser upon viewing the victim's profile.   
  
Note: All webpages of the domain are affected  
  
Vulnerable Parameter:  
SAP Hana Cloud User Account Display Name "Display Name"  
  
Method:   
POST  
  
Exploit Code:  
https://localhost/a/cockpit#/acc/[account-id]/accountmanagement  
  
Post data  
<name="Display Name" value="007"><img src=x onerror=prompt(document.cookie);>  
  
Impact:  
Since there is no requirement of Victim intervention, Session ID and data theft may follow as well as possibility to  
bypass CSRF protections, injection of iframes to establish communication channels etc.  
  
Severity Level:  
Critical  
  
------------------------------------------------------------------------  
  
Vender:   
SAP  
  
Product:   
SAP HANA CLoud  
  
Vulnerability Type:   
Cross site scripting  
  
Title:   
SAP Hana Cloud Cross site scripting in HTML5 Application Name  
  
Details:   
SAP Hana cloud allows users to input arbitrary client side JS code into the HTML5 Application Name parameter. Victim intervention is not required for the successful as the code is stored and execute in the browser upon user edition of the HTML5 application   
  
Vulnerable Parameter:  
SAP Hana Cloud HTML5 Application Name "Application Name"  
  
Method:   
POST  
  
Exploit Code:  
https://localhost/a/cockpit#/acc/[account-id]/hcproxy  
  
Post data  
<name="Application Name" value="007"><img src=x onerror=prompt(document.cookie);>  
  
Impact:  
Since there is no requirement of Victim intervention, Session ID and data theft may follow as well as possibility to  
bypass CSRF protections, injection of iframes to establish communication channels etc.  
  
Severity Level:  
Critical  
  
------------------------------------------------------------------------  
  
Vender:   
SAP  
  
Product:   
SAP HANA CLoud  
  
Vulnerability Type:   
Cross site scripting  
  
Title:   
SAP Hana Cloud Cross scripting in Database Repository Name  
  
Details:   
SAP Hana cloud allows users to input arbitrary client side JS code into the Database Repository Name parameter. Victim intervention is not required for the successful as the code is stored and execute in the browser upon user edition of the Database Repo application   
  
Vulnerable Parameter:  
SAP Hana Cloud HTML5 Database Repository Name "Display Name"  
  
Method:   
POST  
  
Exploit Code:  
https://localhost/a/cockpit#/acc/[account-id]/repositories/[repository-name]/ecmrepositorysettings  
  
Post data  
<name="Display Name" value="007"><img src=x onerror=prompt(document.cookie);>  
  
Impact:  
Since there is no requirement of Victim intervention, Session ID and data theft may follow as well as possibility to  
bypass CSRF protections, injection of iframes to establish communication channels etc.  
  
Severity Level:  
Critical  
`