Security Note Session Forwarding by URL, SAP security note 1277022

SAP security note 1277022, "Session Forwarding by URL". Below are the symptom and SAP recommended solution.

Description

Symptom

This security note addresses a vulnerability where a URL, such as one received via email, allows a user to connect to the SAP system without additional authentication.

Solution

For SAP Web Application Server ABAP 6.40 and SAP NetWeaver Application Server ABAP 7.00, refer to Note 1266780.

Starting with EhP1 for SAP NetWeaver Application Server ABAP 7.00, mitigate the vulnerability by setting the following dynamic profile parameters:

• icf/user_recheck from 0 to 1: Activates reauthentication for each consecutive request in stateful HTTP communication. To suppress reauthentication for specific services, define them in transaction SICF.
• icf/set_HTTPonly_flag_on_cookies from 3 to 0: Sets the HTTPonly attribute for cookies, especially the MYSAPSSO2 cookie, preventing unexpected programmatic access to logon data if the client (e.g., browser) supports HTTPonly.

The solution spans both ABAP and kernel components and requires the following kernel patch levels:

• Kernel 7.01 Patch-level #44 or higher
• Kernel 7.10 Patch-level #157 or higher
• Kernel 7.11 Patch-level #37 or higher
• Kernel 7.20 and above

Refer to the relevant Support Packages for your SAP_BASIS version.

Reason and prerequisites

• The system is not configured for the HTTP Security Session. Refer to transaction SICF_SESSIONS.
• The application uses "stateful-http-communication," meaning the backend session remains open and is reused.
• In the current environment, the session stays open when the user accesses the URL, enabling connection without further authentication.
• The service is not classified as "public." A service is considered "public" if it is defined in /sap/public, or if it is maintained with logon data and only permits the maintained logon data ("mandatory with logon data").

References