Advisory
A note with CVSS 8.8 for component KM-KW-HTA was released by SAP on 14.12.2021. The correction/advisory 3102769 was described with "[CVE-2021-42063] Cross-Site Scripting (XSS) vulnerability in SAP Knowledge Warehouse" and affects the system type Java.
A workaround exists, according to SAP Security Advisory team. It is advisable to implement the correction as part of maintenance.
The vulnerability addressed is cross-site scripting (xss) information disclosure within Java.
Risk specification
This note has been re-released with updated 'Support Packages & Patches’ information. SAP Knowledge Warehouse does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.Solution
The user input is now properly encoded to prevent a successful XSS attack. Although an alternative solution exists, it is advisable to apply the correction! This is the workaround, which was suggested by the SAP security experts: "In case that you cannot implement the patch, you have two options for workaround: Option 1: You may disable the vulnerable application following the documentation in "Config Tool Adding Filters - SAP Help Portal" (https://help.sap.com/viewer/0c333adb55cd4dbf8e92a5175703224c/7.5.19/en-US/47b1a4e5ac671599e10000000a42189c.html). 'Component Name Mask' parameter should be set as tc~km_tc*, 'Vendor Mask' Parameter - sap.com . Option 2: In case the requests are routed via SAP Web Dispatcher you may add a rewrite rule to SAP Web Dispatcher to prevent from redirects according to related note 3221696. Add the following rewrite rule to your Web Dispatcher configuration. RegIForbiddenUrl ^/(SAPIrExtHelp|SAPIKS|KW).* - If there is an existing icm/HTTP/mod_<x> = PREFIX=/, FILE=<...> in your setup: Add the new rule (above) to your existing rule file. Restart the Web Dispatcher or reload the file using the Web Administration UI. Otherwise: Create a new file on the file system (for example in the profile directory) and enter the role above in that file. Add a new parameter icm/HTTP/mod_0 = PREFIX=/, FILE=<your created file>. Restart the Web Dispatcher.".
Affected System
SAP Netweaver Application Server Java is part of the SAP NetWeaver Application Platform. It provides the complete infrastructure for deploying and running Java applications.
- The AS Java Home: SAP Netweaver Application Server Java wiki
- A dedicated SAP NetWeaver 7.40 Application Server for Java Security Guide exists.
The advisory is valid for
- KM-KW_JIKS 7.30
- KM-KW_JIKS 7.31
- KM-KW_JIKS 7.40
- KM-KW_JIKS 7.50
