High Severity
Affected system
SAP Fiori Client Android
CVSS
7.6
Component
MOB-FC
Patch Day
2021-08
Released on
2021/08/10
SAP Note
3067219
Workaround
Yes
  • Share with:

Advisory

A note with CVSS 7.6 for component MOB-FC was released by SAP on 10.08.2021. The correction/advisory 3067219 was described with "[CVE-2021-33699] Task Hijacking in SAP Fiori Client Native Mobile for Android" and affects the system type SAP Fiori Client Android.

A workaround exists, according to SAP Security Advisory team. It is advisable to implement the correction as monthly patch process.

The vulnerability addressed is task hijacking within SAP Fiori Client Android.

Risk specification

An attacker that managed to install a malicious application on an Android Phone running the Fiori native client could highjack the application task and thereby be able to get access to user inputs and sensitive information.

Solution

The Applications AndroidManifest.xml was updated to include taskAffinity = "", to no longer allow Task Highjacking  Although an alternative solution exists, it is advisable to apply the correction! This is the workaround, which was suggested by the SAP security experts: "For customer who is using Cloud Build service to build the customized Fiori Client, they can download the project file and set taskAffinity="", then rebuild the customized Fiori Client locally. For customer who is using WebIDE to build the customized Fiori Client, they should set taskAffinity to empty string via modifying config.xml for their cordova project in webIDE. And then perform a rebuild action from WebIDE.For customer who is using CLI to build the customized Fiori Client, they can modify the taskAffinity="" and rebuild customized Fiori Client.".

The advisory is valid for

  • KAPSEL_ENTERPRISE_BROWSER 1.15
  • KAPSEL_SDK 3.2

 

 

Disclaimer

SecurityBridge takes the security of SAP products very seriously. We very much encourage the responsible disclosure of security vulnerabilities. If you have detected a vulnerability concerning one of the SAP software products – either in the latest or in a former product version follow the guidelines and processes in accordance with the SAP portal page “Report a Security Vulnerability to SAP”.

The advisories found within the SecurityBridge advisory are generated and continuously enriched by our Team at SecurityBridge and affiliated security consultants, partners, customers of the SecurityBridge Platform, SAP support, and advisory groups.

We do not disclose zero-day vulnerabilities unless a security patch has been made available to the public. In such case, the platform only provides details on which version or signature updates are available within the SecurityBridge platform in order to monitor or measure the vulnerability.

In accordance with SAP guidelines, SecurityBridge only discloses issues where the fixing security note has been released. The vulnerability platform makes no references to available exploits or Proof of Concepts (PoC). Advisories and vulnerabilities will always mention the fixing security note or hints to the corresponding SAP documentation.

SecurityBridge

SecurityBridgefor SAP©
empowers security teams with forward-looking, high fidelity, adversary-focused intelligence and actionable events from SAP Netweaver based systems.

Follow us
 
ABEX logo

SecurityBridge helps in prioritizing SAP patches, updates and the remediation
strategies essential for preventing the disruption of vital business systems.
We help businesses in making their SAP systems more secure.

Company

© Copyright 2021 by SecurityBridge // NCMI GmbH