Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1497951-4)
SAP Support Packages
(SAPK-40013INCRMIS, SAPK-70103INWEBCUIF, SAPKU50018, SAPKU52011, SAPKU60009, SAPKU70009, SAPKU70102, SAPKU70103)
Описание
Using ERMS E-mail Workbench and the Agent Inbox E-Mail Editor within the Interaction Center can result in a stored cross site scripting issue.
It can be used to permanently modify displayed content from a web site, allowing the malicious user to embed content that is rendered automatically, without the need to individually target victims.
Stored cross site scripting can also be used to steal another user's authentication information such as data relating to their current session.
An attacker who gains access to this data may use this to impersonate the user and access all information with the same rights as the target user. In case of an administrator being impersonated, a full compromise of the application's security can be may occur.
It can be used to permanently modify displayed content from a web site, allowing the malicious user to embed content that is rendered automatically, without the need to individually target victims.
Stored cross site scripting can also be used to steal another user's authentication information such as data relating to their current session.
An attacker who gains access to this data may use this to impersonate the user and access all information with the same rights as the target user. In case of an administrator being impersonated, a full compromise of the application's security can be may occur.
Как исправить
Apply the following correction instructions and manual steps.
If you want to display HTML content of e-mails within the Interaction Center you have to ensure that your e-mail infrastructure is capable of securing/sanitizing HTML mails with active content (such as but not limited to JavaScript) before sending them to Interaction Center and that these measures (e.g. filtering on the e-mail server) are switched on.
If you are not able to ensure this, deactivate the display of HTML e-mails in Interaction Center by following the manual correction instruction steps for your release.
Additionally you can set up an ERMS rule to handle (e.g. delete) incoming HTML mails and inform the sender automatically that you are not able to view HTML mails. HTML mails can be recognized by the E-Mail Document Type 'HTM' in the ERMS rule modeler after adding the following customizing:
1. Execute IMG activity 'Customer Relationship Management->E-Mail Response Management System->Define Repository'
2. Choose context 'ERMS'. Go to step 'Attributes'
3. Add the following entry:
Attribute: <Attribute ID> (e.g. ZMAIL_DOCTYPE)
Description: E-Mail Document Type
Show Attribute: X
XPath: /parts/EMAIL/OBJ_TYPE/text()
Fact Gathering Service: FG_EMAIL
Attribute Extension Class: CL_CRM_ERMS_ATTR_EXT_EQUALS
------------------------------------------------------------------------
|Manual Pre-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component BBPCRM BBP / CRM |
| Release 701 Until SAPKU70102 |
------------------------------------------------------------------------
1. Apply spupport package for WEBCUIF SP03 or do the following manual steps:
a) Start transaction SE80 and create in package CRM_IC_CUSTOMIZING2 the followung objects.
b) Domain: CRM_IC_HTMLMAIL_DISP
Data Type CHAR
No. Characters 3
Decimal Places 0
With the following fixed values:
<empty> Enabled
DIS Disabled
c) Data Element: CRMT_IC_HTMLMAIL_DISP
Domain: CRM_IC_HTMLMAIL_DISP
d) Add a new field to table CRMC_IC_EMAIL
Field: HTMLDISPLAY
Data Element: CRMT_IC_HTMLMAIL_DISP
e) Activate your changes
2. Create the following message for message class CRM_ERMS_EMAIL via transaction SE91:
Message number: 002
Message text: HTML mail display is disabled; HTML content was removed from mail
------------------------------------------------------------------------
|Manual Pre-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component BBPCRM BBP / CRM |
| Release 700 All Support Package Levels |
------------------------------------------------------------------------
1. Create the following message for message class CRM_ERMS_EMAILCLIENT via transaction SE91:
Message number: 002
Message text: HTML mail display is disabled; HTML content was removed from mail.
2. Call TA SM30 and modify table SMOFPARSFA by adding the following entries:
Key = CRMIC
Parameter Name = HTMLDISPLAY
Param. Value = DIS
Set Param. Name 2 to your E-Mail profile. Add more rows for every E-Mail profile.
------------------------------------------------------------------------
|Manual Pre-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component BBPCRM BBP / CRM |
| Release 600 Until SAPKU60008 |
------------------------------------------------------------------------
1. Create the following message for message class CRM_ERMS_EMAILCLIENT via transaction SE91:
Message number: 003
Message text: HTML mail display is disabled; HTML content was removed from mail.
2. Call TA SM30 and modify table SMOFPARSFA by adding the following entries:
Key = CRMIC
Parameter Name = HTMLDISPLAY
Param. Value = DIS
Set Param. Name 2 to your E-Mail profile. Add more rows for every E-Mail profile.
------------------------------------------------------------------------
|Manual Pre-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component BBPCRM BBP / CRM |
| Release 520 Until SAPKU52010 |
------------------------------------------------------------------------
1. Create the following message for message class CRM_ERMS_EMAILCLIENT via transaction SE91:
Message number: 002
Message text: HTML mail display is disabled; HTML content was removed from mail.
2. Call TA SM30 and modify table SMOFPARSFA by adding the following entries:
Key = CRMIC
Parameter Name = HTMLDISPLAY
Param. Value = DIS
Set Param. Name 2 to your E-Mail profile. Add more rows for every E-Mail profile.
------------------------------------------------------------------------
|Manual Post-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component BBPCRM BBP / CRM |
| Release 500 Until SAPKU50017 |
------------------------------------------------------------------------
1. Create the following message for message class CRM_ERMS_WORKBENCH via transaction SE91:
Message number: 050
Message text: HTML mail display is disabled; HTML content was removed from mail.
2. Call TA SM30 and modify table SMOFPARSFA by adding the following entries:
Key = CRMIC
Parameter Name = HTMLDISPLAY
Param. Value = DIS
Set Param. Name 2 to your E-Mail profile. Add more rows for every E-Mail profile.
------------------------------------------------------------------------
|Manual Post-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component CRMIS SAP CRM 4.0 Add...|
| Release 400 Until SAPK-40012INCRMIS |
------------------------------------------------------------------------
1. Create the following message for message class CRM_ERMS via transaction SE91:
Message number: 002
Message text: HTML mail display is disabled; HTML content was removed from mail.
2. Call TA SM30 and modify table SMOFPARSFA by adding the following entries:
Key = CRMIC
Parameter Name = HTMLDISPLAY
Param. Value = DIS
Set Param. Name 2 to your E-Mail profile. Add more rows for every E-Mail profile.
If you want to display HTML content of e-mails within the Interaction Center you have to ensure that your e-mail infrastructure is capable of securing/sanitizing HTML mails with active content (such as but not limited to JavaScript) before sending them to Interaction Center and that these measures (e.g. filtering on the e-mail server) are switched on.
If you are not able to ensure this, deactivate the display of HTML e-mails in Interaction Center by following the manual correction instruction steps for your release.
Additionally you can set up an ERMS rule to handle (e.g. delete) incoming HTML mails and inform the sender automatically that you are not able to view HTML mails. HTML mails can be recognized by the E-Mail Document Type 'HTM' in the ERMS rule modeler after adding the following customizing:
1. Execute IMG activity 'Customer Relationship Management->E-Mail Response Management System->Define Repository'
2. Choose context 'ERMS'. Go to step 'Attributes'
3. Add the following entry:
Attribute: <Attribute ID> (e.g. ZMAIL_DOCTYPE)
Description: E-Mail Document Type
Show Attribute: X
XPath: /parts/EMAIL/OBJ_TYPE/text()
Fact Gathering Service: FG_EMAIL
Attribute Extension Class: CL_CRM_ERMS_ATTR_EXT_EQUALS
------------------------------------------------------------------------
|Manual Pre-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component BBPCRM BBP / CRM |
| Release 701 Until SAPKU70102 |
------------------------------------------------------------------------
1. Apply spupport package for WEBCUIF SP03 or do the following manual steps:
a) Start transaction SE80 and create in package CRM_IC_CUSTOMIZING2 the followung objects.
b) Domain: CRM_IC_HTMLMAIL_DISP
Data Type CHAR
No. Characters 3
Decimal Places 0
With the following fixed values:
<empty> Enabled
DIS Disabled
c) Data Element: CRMT_IC_HTMLMAIL_DISP
Domain: CRM_IC_HTMLMAIL_DISP
d) Add a new field to table CRMC_IC_EMAIL
Field: HTMLDISPLAY
Data Element: CRMT_IC_HTMLMAIL_DISP
e) Activate your changes
2. Create the following message for message class CRM_ERMS_EMAIL via transaction SE91:
Message number: 002
Message text: HTML mail display is disabled; HTML content was removed from mail
------------------------------------------------------------------------
|Manual Pre-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component BBPCRM BBP / CRM |
| Release 700 All Support Package Levels |
------------------------------------------------------------------------
1. Create the following message for message class CRM_ERMS_EMAILCLIENT via transaction SE91:
Message number: 002
Message text: HTML mail display is disabled; HTML content was removed from mail.
2. Call TA SM30 and modify table SMOFPARSFA by adding the following entries:
Key = CRMIC
Parameter Name = HTMLDISPLAY
Param. Value = DIS
Set Param. Name 2 to your E-Mail profile. Add more rows for every E-Mail profile.
------------------------------------------------------------------------
|Manual Pre-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component BBPCRM BBP / CRM |
| Release 600 Until SAPKU60008 |
------------------------------------------------------------------------
1. Create the following message for message class CRM_ERMS_EMAILCLIENT via transaction SE91:
Message number: 003
Message text: HTML mail display is disabled; HTML content was removed from mail.
2. Call TA SM30 and modify table SMOFPARSFA by adding the following entries:
Key = CRMIC
Parameter Name = HTMLDISPLAY
Param. Value = DIS
Set Param. Name 2 to your E-Mail profile. Add more rows for every E-Mail profile.
------------------------------------------------------------------------
|Manual Pre-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component BBPCRM BBP / CRM |
| Release 520 Until SAPKU52010 |
------------------------------------------------------------------------
1. Create the following message for message class CRM_ERMS_EMAILCLIENT via transaction SE91:
Message number: 002
Message text: HTML mail display is disabled; HTML content was removed from mail.
2. Call TA SM30 and modify table SMOFPARSFA by adding the following entries:
Key = CRMIC
Parameter Name = HTMLDISPLAY
Param. Value = DIS
Set Param. Name 2 to your E-Mail profile. Add more rows for every E-Mail profile.
------------------------------------------------------------------------
|Manual Post-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component BBPCRM BBP / CRM |
| Release 500 Until SAPKU50017 |
------------------------------------------------------------------------
1. Create the following message for message class CRM_ERMS_WORKBENCH via transaction SE91:
Message number: 050
Message text: HTML mail display is disabled; HTML content was removed from mail.
2. Call TA SM30 and modify table SMOFPARSFA by adding the following entries:
Key = CRMIC
Parameter Name = HTMLDISPLAY
Param. Value = DIS
Set Param. Name 2 to your E-Mail profile. Add more rows for every E-Mail profile.
------------------------------------------------------------------------
|Manual Post-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component CRMIS SAP CRM 4.0 Add...|
| Release 400 Until SAPK-40012INCRMIS |
------------------------------------------------------------------------
1. Create the following message for message class CRM_ERMS via transaction SE91:
Message number: 002
Message text: HTML mail display is disabled; HTML content was removed from mail.
2. Call TA SM30 and modify table SMOFPARSFA by adding the following entries:
Key = CRMIC
Parameter Name = HTMLDISPLAY
Param. Value = DIS
Set Param. Name 2 to your E-Mail profile. Add more rows for every E-Mail profile.
Ссылки
