Is uPerform safe?

Question

Is uPerform safe?

Accepted Answer

Our review of uPerform surfaced the following. The uPerform® In-application Help extension reads a server URL from the page's localStorage on every page load. Any web page — including one the attacker controls — can write a URL to localStorage['serversArr'], and the extension will contact that URL to fetch profile configuration. We confirmed this behavior during dynamic analysis: after planting a marker server URL in localStorage['serversArr'], the extension's background process made GET requests to that server. If the attacker's profile response includes an inAppCloudFrontPath value and the user subsequently visits a SAP Fiori page (identified by the presence of window.sap and window.$), the extension writes that value to localStorage and injects it as the src of a dynamically-created script element, loading external JavaScript into the SAP Fiori page.

Is uPerform® In-application Help safe?

Findings