CVE-2024-37174
📋 TL;DR
This CVE describes a cross-site scripting (XSS) vulnerability in SAP CRM WebClient UI's custom CSS support option. Attackers can inject malicious scripts through user-controlled inputs, potentially compromising user sessions and data integrity. Organizations using affected SAP CRM versions are vulnerable.
💻 Affected Systems
- SAP CRM WebClient UI
📦 What is this software?
Customer Relationship Management S4fnd by Sap
View all CVEs affecting Customer Relationship Management S4fnd →
Customer Relationship Management S4fnd by Sap
View all CVEs affecting Customer Relationship Management S4fnd →
Customer Relationship Management S4fnd by Sap
View all CVEs affecting Customer Relationship Management S4fnd →
Customer Relationship Management S4fnd by Sap
View all CVEs affecting Customer Relationship Management S4fnd →
Customer Relationship Management S4fnd by Sap
View all CVEs affecting Customer Relationship Management S4fnd →
Customer Relationship Management S4fnd by Sap
View all CVEs affecting Customer Relationship Management S4fnd →
Customer Relationship Management S4fnd by Sap
View all CVEs affecting Customer Relationship Management S4fnd →
Customer Relationship Management Webclient Ui by Sap
View all CVEs affecting Customer Relationship Management Webclient Ui →
Customer Relationship Management Webclient Ui by Sap
View all CVEs affecting Customer Relationship Management Webclient Ui →
Customer Relationship Management Webclient Ui by Sap
View all CVEs affecting Customer Relationship Management Webclient Ui →
Customer Relationship Management Webclient Ui by Sap
View all CVEs affecting Customer Relationship Management Webclient Ui →
Customer Relationship Management Webclient Ui by Sap
View all CVEs affecting Customer Relationship Management Webclient Ui →
⚠️ Risk & Real-World Impact
Worst Case
Attacker steals authenticated user sessions, performs actions as legitimate users, and exfiltrates sensitive CRM data.
Likely Case
Attacker injects malicious scripts to steal session cookies or redirect users to phishing sites, compromising individual user accounts.
If Mitigated
With proper input validation and output encoding, the vulnerability is prevented, maintaining normal application functionality.
🎯 Exploit Status
Exploitation requires user interaction or access to input fields, but XSS techniques are well-documented and easy to implement.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply SAP Security Note 3467377
Vendor Advisory: https://me.sap.com/notes/3467377
Restart Required: Yes
Instructions:
1. Download SAP Note 3467377 from SAP Support Portal.
2. Apply the security patch to affected SAP CRM systems.
3. Restart the application server to activate changes.
4. Verify the fix by testing custom CSS inputs.
🔧 Temporary Workarounds
Disable Custom CSS Support
allTemporarily disable the vulnerable custom CSS feature to prevent exploitation.
Navigate to SAP CRM WebClient UI configuration and disable custom CSS support option.
Implement Input Validation
allAdd server-side validation to sanitize CSS inputs before processing.
Implement input validation rules to reject or sanitize malicious script tags in CSS inputs.
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block XSS payloads in CSS inputs.
- Restrict access to custom CSS features to trusted users only.
🔍 How to Verify
Check if Vulnerable:
Test by injecting a simple XSS payload (e.g., <script>alert('test')</script>) into custom CSS input fields and check if it executes.Check Version:
Check SAP system version via transaction code SM51 or consult SAP Note 3467377 for patch verification.Verify Fix Applied:
After patching, repeat the XSS test; the payload should be encoded or blocked, not executed.📡 Detection & Monitoring
Log Indicators:
- Unusual or malicious script patterns in custom CSS input logs.
- Multiple failed login attempts following CSS input changes.
Network Indicators:
- HTTP requests containing script tags in CSS parameters.
- Outbound connections to suspicious domains from CRM sessions.
SIEM Query:
source="sap_crm_logs" AND (message="*<script>*" OR message="*javascript:*")