2584438 - Vulnerability scan against Fiori Launchpad reports XSS in PAGE_BUILDER service

Symptom

An automated vulnerability scan returns a potential reflected XSS vulnerability against the PAGE_BUILDER (PAGE_BUILDER_PERS) service in the Fiori Launchpad, indicating that code can be injected into requests, then are returned and executed.

Example:

https://<server>:<port>/sap/opu/odata/UI2/PAGE_BUILDER_PERS/PageSets('%2FUI2%2FFiori2LaunchpadHome')?$expand=<img src=x onerror=alert(HI)>Pages/PageChipInstances/Chip/ChipBags/ChipProperties,Pages/PageChipInstances/RemoteCatalog,Pages/PageChipInstances/ChipInstanceBags/ChipInstanceProperties,AssignedPages,DefaultPage

would purportedly cause the browser to trigger an alert with the message "HI"

Product

SAP Fiori front-end server all versions ; SAP NetWeaver all versions

Keywords

PAGE_BUILDER_PERS, Pages, PageSets , KBA , CA-UI2-INT-BE , Please use CA-FLP-ABA , CA-FE-FLP-EU , Please use CA-FLP-FE-UI , CA-UI2-INT-FE , Please use CA-FLP-FE-COR , Problem

About this page

This is a preview of a SAP Knowledge Base Article. Click more to access the full version on SAP for Me (Login required).

Search for additional results

Visit SAP Support Portal's SAP Notes and KBA Search.