CVE-2024-37174 Overview
CVE-2024-37174 is a Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Custom CSS support option of SAP Customer Relationship Management (CRM) WebClient UI. The component fails to sufficiently encode user-controlled inputs, allowing an attacker to inject script content that executes in a victim's browser session. Exploitation requires user interaction and produces a limited impact on confidentiality and integrity, with no direct impact on availability. The scope is changed, meaning injected script can affect resources beyond the vulnerable component's security authority. SAP addressed the issue through Security Note #3467377 released on SAP Security Patch Day.
Critical Impact
An unauthenticated attacker can craft malicious CSS payloads that execute script in the context of an authenticated SAP CRM WebClient UI user, enabling session data theft and limited UI manipulation.
Affected Products
- SAP Customer Relationship Management S4FND versions 102, 103, 104, 105, 106, 107, 108
- SAP Customer Relationship Management WebClient UI versions 701, 731, 746, 747, 748
- SAP Customer Relationship Management WebClient UI versions 800, 801
Discovery Timeline
- 2024-07-09 - CVE-2024-37174 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-37174
Vulnerability Analysis
The vulnerability resides in the Custom CSS support option of the SAP CRM WebClient UI. Administrators and privileged users can supply CSS content to customize the appearance of the WebClient. The affected code path does not enforce sufficient output encoding on user-supplied CSS values before rendering them into the browser context. Attackers can embed script-bearing constructs within the CSS payload that execute when a targeted user loads a page referencing the customized style. Because the CVSS scope is marked as Changed, injected content in the WebClient UI can affect resources outside the originating security boundary, such as parent frames or session-scoped data.
Root Cause
The root cause is improper neutralization of input during web page generation [CWE-79]. The Custom CSS handling logic accepts user-controlled strings and writes them into HTML or style contexts without applying encoding routines appropriate for those sinks. Content that should be treated as untrusted style data is instead rendered in a way that permits script execution.
Attack Vector
The attack is network-based and requires user interaction. An attacker with the ability to influence Custom CSS content, or who lures a user into loading a URL that renders attacker-controlled CSS, can trigger script execution in the victim's authenticated session. Successful exploitation can expose session identifiers, CSRF tokens, or displayed business data, and can modify parts of the rendered CRM interface.
See SAP Note #3467377 for authoritative technical details on the vulnerable code path and fix.
Detection Methods for CVE-2024-37174
Indicators of Compromise
- Custom CSS configuration entries in SAP CRM WebClient UI containing HTML tags, <script> fragments, javascript: URIs, or CSS expression() constructs
- Web server or reverse proxy logs showing HTTP requests to CRM WebClient UI endpoints with encoded script payloads in CSS parameters
- Unexpected outbound requests from browsers of CRM WebClient users to attacker-controlled domains after loading customized UI pages
Detection Strategies
- Audit stored Custom CSS values in SAP CRM WebClient UI configuration tables and flag entries containing script-like syntax or non-CSS keywords
- Deploy Content Security Policy (CSP) reporting on the SAP CRM WebClient UI domain to surface inline-script violations that indicate XSS attempts
- Correlate changes to CRM WebClient UI customization objects with user identity and change timestamps in the SAP change document log
Monitoring Recommendations
- Ingest SAP CRM WebClient UI access logs and security audit logs into a centralized data lake for query and retention
- Alert on any modification of Custom CSS support settings by users outside an approved change-management group
- Monitor browser telemetry from endpoints running CRM WebClient sessions for anomalous script execution or DOM modifications
How to Mitigate CVE-2024-37174
Immediate Actions Required
- Apply the fix documented in SAP Note #3467377 to all affected SAP CRM S4FND and WebClient UI components
- Review and sanitize existing Custom CSS entries stored in the SAP CRM WebClient UI configuration and remove any content that includes markup or script constructs
- Restrict the authorization objects that grant permission to modify Custom CSS support settings to a minimum set of trusted administrators
Patch Information
SAP released the fix as part of the July 2024 SAP Security Patch Day. Customers should implement SAP Note #3467377 on all affected S4FND releases (102–108) and WebClient UI releases (701, 731, 746, 747, 748, 800, 801). Refer to the SAP Security Patch Day portal for the corresponding support package levels and deployment guidance.
Workarounds
- Disable the Custom CSS support option in the SAP CRM WebClient UI configuration until the SAP Note can be applied
- Enforce a strict Content Security Policy on the SAP CRM WebClient UI domain that disallows inline script and untrusted style sources
- Require change-management approval and code review for any Custom CSS submission prior to activation in production
# Configuration example - refer to SAP Note #3467377 for authoritative steps
# Restrict authorizations to modify Custom CSS via role/profile maintenance (PFCG)
# and disable the Custom CSS option in WebClient UI customizing until patched.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
