Cross-Site Scripting XSS vulnerability in SAP NetWeaver AS ABAP
Impact On Business
Impact depends on the victim’s privileges. In worst cases, a successful attack allows an attacker to hijack a session, or force the victim to perform undesired requests in the SAP system.
Affected Components Description
The SAP Host Agent can accomplish several life-cycle tasks like : operating system monitoring, database monitoring, system instance control or upgrade preparation. Installed automatically during the installation of the new SAP system, it’s an OS independent and mandatory application.
Vulnerability Details
The SAP NetWeaver public HTTP service /sap/public/bsp/sap/public/graphics/jnet_handler/ provides the possibility to WRITEFILE into the system shared memory. The LOADGUID allows access to the previously saved file. The HTTP response is forced to be text/xml, but an attacker could use this to store malicious javascript then trick the victim to click on it.
Solution
SAP has released SAP Note 3274585 which provides patched versions of the affected components.
The patches can be downloaded from https://me.sap.com/notes/3274585.
Onapsis strongly recommends SAP customers to download the related security fixes and apply them to the affected components in order to reduce business risks.
Report Timeline
- 11/17/2022: Onapsis sends details to SAP
- 11/17/2022: SAP Provided incident number
- 02/14/2023: SAP releases SAP Note fixing the issue
References
- Onapsis blogpost: https://onapsis.com/blog/sap-patch-day-february-2023/
- CVE Mitre: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25614
- Vendor Patch: https://me.sap.com/notes/3274585
Advisory Information
- Public Release Date: 07/18/25
- Security Advisory ID: ONAPSIS-2024-0015
- Researcher(s): Yvan Genuer
Vulnerability Information
- Vendor: SAP
- Affected Components:
- SAP_BASIS 700 SP 40 and lower
- SAP_BASIS 701 SP 25 and lower
- SAP_BASIS 702 SP 25 and lower
- SAP_BASIS 731 SP 32 and lower
- SAP_BASIS 740 SP 29 and lower
- SAP_BASIS 750 SP 25 and lower
- SAP_BASIS 751 SP 15 and lower
- SAP_BASIS 752 SP 11 and lower
- SAP_BASIS 753 SP 09 and lower
- SAP_BASIS 754 SP 07 and lower
- SAP_BASIS 755 SP 05 and lower
- SAP_BASIS 756 SP 03 and lower
- SAP_BASIS 757 SP 01 and lower
(Check SAP Note 3274585 for detailed information on affected releases)
- Vulnerability Class: CWE-79
- CVSS v3 score: 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Risk Level: Medium
- Assigned CVE: CVE-2023-25614
- Vendor patch Information: SAP Security NOTE 3274585
About our Research Labs
Onapsis Research Labs provides the industry analysis of key security issues that impact mission-critical systems and applications.
Delivering frequent and timely security and compliance advisories with associated risk levels, Onapsis Research Labs combine in-depth knowledge and experience to deliver technical and business-context with sound security judgment to the broader information security community.
Find all reported vulnerabilities at:
https://github.com/Onapsis/vulnerability_advisories
This advisory is licensed under a Creative Commons 4.0 BY-ND International License