Executive brief
SAP less-openui5 is a tool used by developers to build themes for OpenUI5 and SAPUI5 applications. A vulnerability in how it processes theme files allows an attacker to embed malicious code within a theme. If a developer or build system processes a malicious theme file, the attacker's code could execute on their machine, potentially leading to a full system compromise or data theft.
Technical details
The less-openui5 package uses a fork of Less.js v1.6.3 which supports an 'Inline JavaScript' feature. This feature allows JavaScript code embedded within backticks inside a .less file to be evaluated during the CSS compilation process. An attacker can exploit this by providing a malicious theme or library containing a crafted .less file. When a developer or automated build pipeline processes this file using less-openui5, the embedded JavaScript executes in the context of the build process. The vulnerability was addressed in version 0.10.0 by completely removing the inline JavaScript evaluation feature and the 'javascriptEnabled' parser option.
Affected products
- SAP less-openui5 < 0.10.0
Timeline
- 2021-01-29: patched: Fix released in version 0.10.0
- 2021-01-29: advisory: GitHub Security Advisory published
- 2021-02-16: disclosed: CVE-2021-21316 published to NVD