Digital Security Research Group has reported multiple vulnerabilities in SAP NetWeaver, which can be exploited by malicious users to conduct script insertion attacks and by malicious people to bypass certain security restrictions and conduct cross-site scripting attacks.

1) An error within the handling of access controls of certain resources can be exploited to gain access to otherwise restricted Runtime Workbench resources.

2) An error within the "PFL_CHECK_OS_FILE_EXISTENCE" function in the implementation of access restrictions can be exploited to enumerate files on a system.

3) Input passed via the "TXVDestination" parameter to TextContainerAdmin/administration_setup.jsp and the "ValueIndustry", "ValueRegion", and "ValueExtension" parameters to system_context_settings.jsp is not properly sanitised before being displayed to the user. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed.

Successful exploitation of this vulnerability may require administrative privileges.

4) Input passed e.g. via the "cc0Host", "cc0Id", "cc0Path", "cc0Port", and "cc0Protocol" parameters to bcbadmSettings.jsp is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Solution
Apply SAP security notes 1567389, 1591146, 1591749, and 1585652.

Provided and/or discovered by
1) Alexander Polyakov DSecRG
2) Alexey Tuyrin, DSecRG
3) Neyolov Evgeny, DSecRG
4) Dmitriy Evdokimov, DSecRG

Original Advisory
SAP:
https://service.sap.com/sap/support/notes/1567389
https://service.sap.com/sap/support/notes/1591146
https://service.sap.com/sap/support/notes/1591749
https://service.sap.com/sap/support/notes/1585652

DSecRG (DSECRG-12-008, DSECRG-12-009, DSECRG-12-010, DSECRG-12-011):
http://dsecrg.com/pages/vul/show.php?id=408
http://dsecrg.com/pages/vul/show.php?id=409
http://dsecrg.com/pages/vul/show.php?id=410
http://dsecrg.com/pages/vul/show.php?id=411

Deep Links
Links available to Secunia VIM customers