CVE-2024-37173: SAP CRM WebClient UI XSS Vulnerability

CVE-2024-37173 Overview

CVE-2024-37173 is a reflected Cross-Site Scripting (XSS) vulnerability in the SAP Customer Relationship Management (CRM) WebClient UI. The flaw stems from insufficient input validation, allowing an unauthenticated attacker to craft a URL that embeds a malicious script. When a victim clicks the crafted link, the script executes in the victim's browser under the origin of the SAP CRM WebClient UI application. The attacker can then access or modify information available to the victim's session without impacting application availability. The issue affects multiple releases of SAP CRM S4FND and SAP CRM WebClient UI components and is tracked under [CWE-79].

Critical Impact
Successful exploitation enables session-context script execution against authenticated SAP CRM users, exposing confidential business data and enabling unauthorized modifications through the victim's browser.

Affected Products

SAP Customer Relationship Management S4FND versions 102, 103, 104, 105, 106, 107, 108
SAP Customer Relationship Management WebClient UI versions 701, 731, 746, 747, 748
SAP Customer Relationship Management WebClient UI versions 800, 801

Discovery Timeline

2024-07-09 - CVE-2024-37173 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-37173

Vulnerability Analysis

The vulnerability is a reflected XSS flaw [CWE-79] in the SAP CRM WebClient UI. Server-side handlers accept user-controlled input via URL parameters and echo the values into HTTP responses without proper encoding or sanitization. An attacker crafts a URL that includes JavaScript payloads in one of the reflected parameters. When a targeted user clicks the link, the browser interprets the injected content as executable script within the trusted SAP CRM origin. Because the payload runs in the victim's session context, it can read Document Object Model (DOM) content, extract session tokens accessible to JavaScript, submit forms on behalf of the user, or exfiltrate CRM data to an attacker-controlled endpoint. Exploitation requires user interaction but no authentication on the attacker's side, so phishing or link-planting on trusted channels are viable delivery vectors.

Root Cause

The root cause is missing or incomplete output encoding on user-controlled URL parameters rendered by the WebClient UI framework. Input reaching HTML sinks is not neutralized against script contexts, permitting reflected script injection.

Attack Vector

The attack is delivered over the network. An unauthenticated attacker constructs a malicious URL pointing to a vulnerable SAP CRM WebClient UI endpoint and delivers it via email, chat, or a third-party site. When an authenticated CRM user activates the link, the injected script executes with the privileges of that user's session and can pivot to CRM records accessible to that account. See SAP Note #3467377 for authoritative technical details.

Detection Methods for CVE-2024-37173

Indicators of Compromise

Inbound HTTP requests to SAP CRM WebClient UI endpoints containing URL parameters with <script>, javascript:, onerror=, onload=, or encoded variants such as %3Cscript%3E.
Referer headers on CRM sessions originating from unexpected external domains, followed by outbound requests to unfamiliar hosts.
Web server or reverse proxy logs showing abnormally long query strings targeting CRM WebClient UI paths.

Detection Strategies

Deploy Web Application Firewall (WAF) rules that inspect query strings destined for SAP CRM WebClient UI URLs and block reflected XSS payload patterns.
Correlate CRM access logs with browser telemetry to identify sessions that load third-party scripts or issue anomalous cross-origin requests after clicking external links.
Hunt across proxy and endpoint telemetry for user-agent activity that navigates to CRM URLs carrying encoded HTML or JavaScript tokens.

Monitoring Recommendations

Enable verbose HTTP request logging on the SAP Internet Communication Manager (ICM) and forward logs to a centralized analytics platform.
Alert on Content Security Policy (CSP) violation reports if CSP is configured for the CRM WebClient UI.
Monitor for unusual data export or record modification patterns performed shortly after a user clicks an external link.

How to Mitigate CVE-2024-37173

Immediate Actions Required

Apply the SAP Security Patch Day fixes referenced in SAP Note #3467377 to all affected S4FND and WebClient UI releases.
Inventory exposed SAP CRM WebClient UI instances and restrict internet exposure where business requirements allow.
Notify CRM users of the phishing-based delivery vector and reinforce guidance against clicking unsolicited CRM links.

Patch Information

SAP addressed CVE-2024-37173 through its Security Patch Day process. Administrators should consult the SAP Security Patch Day Announcement and implement the corrections in SAP Note #3467377 for each affected S4FND (102–108) and WebClient UI (701, 731, 746–748, 800, 801) release.

Workarounds

Enforce a strict Content Security Policy that disables inline scripts and restricts script sources for CRM WebClient UI responses.
Configure the reverse proxy or WAF in front of SAP CRM to filter query parameters containing HTML and JavaScript metacharacters.
Set the HttpOnly and Secure flags on session cookies to limit script access to authentication tokens.

bash

# Example WAF rule (ModSecurity) blocking reflected XSS patterns on CRM WebClient UI paths
SecRule REQUEST_URI "@beginsWith /sap/bc/bsp/sap/crm_ui" \
  "chain,phase:2,deny,status:403,id:1004737173,msg:'Potential XSS targeting SAP CRM WebClient UI (CVE-2024-37173)'"
  SecRule ARGS "@rx (?i)(<script|javascript:|onerror=|onload=|%3Cscript)" "t:none,t:urlDecodeUni"