SAP HANA 4 Cross Site Scripting
Posted on 14 January 2016
SAP Hana Cloud Platform Cockpit Cross site Scripting Vulnerabilities ======================================================================== Vender: SAP Product: SAP HANA CLoud Vulnerability Type: Cross site scripting Title: SAP Hana Cloud Cross scripting in User Display Name Details: SAP Hana cloud allows any user with the least privileges to input arbitrary client side JS code into the Display Name parameter. Victim intervention is not required for the successful as the code is stored and execute in the browser upon viewing the victim's profile. Note: All webpages of the domain are affected Vulnerable Parameter: SAP Hana Cloud User Account Display Name "Display Name" Method: POST Exploit Code: https://localhost/a/cockpit#/acc/[account-id]/accountmanagement Post data <name="Display Name" value="007"><img src=x onerror=prompt(document.cookie);> Impact: Since there is no requirement of Victim intervention, Session ID and data theft may follow as well as possibility to bypass CSRF protections, injection of iframes to establish communication channels etc. Severity Level: Critical ------------------------------------------------------------------------ Vender: SAP Product: SAP HANA CLoud Vulnerability Type: Cross site scripting Title: SAP Hana Cloud Cross site scripting in HTML5 Application Name Details: SAP Hana cloud allows users to input arbitrary client side JS code into the HTML5 Application Name parameter. Victim intervention is not required for the successful as the code is stored and execute in the browser upon user edition of the HTML5 application Vulnerable Parameter: SAP Hana Cloud HTML5 Application Name "Application Name" Method: POST Exploit Code: https://localhost/a/cockpit#/acc/[account-id]/hcproxy Post data <name="Application Name" value="007"><img src=x onerror=prompt(document.cookie);> Impact: Since there is no requirement of Victim intervention, Session ID and data theft may follow as well as possibility to bypass CSRF protections, injection of iframes to establish communication channels etc. Severity Level: Critical ------------------------------------------------------------------------ Vender: SAP Product: SAP HANA CLoud Vulnerability Type: Cross site scripting Title: SAP Hana Cloud Cross scripting in Database Repository Name Details: SAP Hana cloud allows users to input arbitrary client side JS code into the Database Repository Name parameter. Victim intervention is not required for the successful as the code is stored and execute in the browser upon user edition of the Database Repo application Vulnerable Parameter: SAP Hana Cloud HTML5 Database Repository Name "Display Name" Method: POST Exploit Code: https://localhost/a/cockpit#/acc/[account-id]/repositories/[repository-name]/ecmrepositorysettings Post data <name="Display Name" value="007"><img src=x onerror=prompt(document.cookie);> Impact: Since there is no requirement of Victim intervention, Session ID and data theft may follow as well as possibility to bypass CSRF protections, injection of iframes to establish communication channels etc. Severity Level: Critical
