SAP Afaria 7 Cross Site Scripting Vulnerability

Application:                SAP Afaria
Versions Affected: SAP Afaria 7, probably others
Vendor URL: http://SAP.com
Bugs: Stored XSS
Send:                           18.02.2015
Reported: 18.02.2015
Vendor response: 18.02.2015
Date of Public Advisory: 11.08.2015
Reference: SAP Security Note 2152669
Author:        Dmitry Chastukhin (ERPScan)



Description


1. ADVISORY INFORMATION
Title: SAP Afaria – Stored XSS
Advisory ID: [ERPSCAN-15-019]
Risk: Hight
Advisory URL: http://erpscan.com/advisories/erpscan-15-019-sap-afaria-stored-xss/
Date published: 11.08.2015
Vendors contacted: SAP

2. VULNERABILITY INFORMATION
Class: XML External Entity [CWE-79]
Impact: Stored cross-site scripting, XSS, Afaria Server, Configuration
Information Disclosure
Remotely Exploitable: Yes
Locally Exploitable: No
CVE Name: CVE-2015-6663

CVSS Information
CVSS Base Score:  4.3 / 10
CVSS Base Vector:
AV : Access Vector (Related exploit range) Network (N)
AC : Access Complexity (Required attack complexity) Medium (M)
Au : Authentication (Level of authentication needed to exploit) None (N)
C : Impact to Confidentiality None (N)
I  : Impact to Integrity Partial (P)
A : Impact to Availability None (N)



3. VULNERABILITY DESCRIPTION
The SAP Afaria Server can be abused by attackers, allowing them to
modify application content, persist the modified content without
authorization, and potentially obtain authentication information of
other legitimate users.



4. VULNERABLE PACKAGES
SAP Afaria 7
Other versions are probably affected too, but they were not checked.

5. SOLUTIONS AND WORKAROUNDS
To correct this vulnerability, install SAP Security Note 2152669


6. AUTHOR
Dmitry Chastukhin (ERPScan)


7. TECHNICAL DESCRIPTION
Anonymous attackers can use special request to inject a malicious JS
code by sending data to the attachment (q) on xComms port (by default,
3007).



8. REPORT TIMELINE
Send:                           18.02.2015
Reported: 18.02.2015
Vendor response: 18.02.2015
Date of Public Advisory: 11.08.2015

#  0day.today [2018-04-10]  #