SAP security note 1262354, "SAP E-Sourcing Ethical Security Hack: Cross-Site Framing", is a note. Below are the symptom and SAP recommended solution.
Description
Symptom
SAP E-Sourcing customers using Microsoft Internet Explorer may be vulnerable to a cross-site framing attack due to an access validation error. Cross-site framing occurs when other sites embed the SAP E-Sourcing application within a frame, potentially allowing phishing or spoofing attacks that can steal user data.
Solution
This security issue is related to the use of SAP E-Sourcing with Microsoft Internet Explorer. Additionally, some customers may need to embed SAP E-Sourcing into another website, such as an enterprise portal. This security fix addresses both scenarios.
A new configurable property, system.friendlyEmbeddingDomains, has been introduced to control which internet domains (e.g., *.mytrusteddomain.com) are considered “friendly” for embedding SAP E-Sourcing. If the top-level URL matches a friendly domain, SAP E-Sourcing continues to function normally. Otherwise, it reloads in the browser’s top frame, removing any wrapping frames.
Property name: system.friendlyEmbeddingDomains. Availability: not available by default; must be configured by a system or enterprise administrator.
Configuration steps: navigate to Setup > Configuration > System Properties, then click Create to add the new property system.friendlyEmbeddingDomains under the System Category.
The value should be a JavaScript regular expression that matches the host names of trusted embedding domains. Examples:
- To allow only ides.sap.com: ^ides\.sap\.com$
- To allow multiple specific domains: (^ides\.sap\.com$)|(ides\.sap-ag\.de$)
- To allow all subdomains of sap.com: \.sap\.com$
New behavior based on system.friendlyEmbeddingDomains: if the embedding domain matches the regular expression, SAP E-Sourcing operates in embedded mode. If the embedding domain does not match, SAP E-Sourcing reloads in the browser’s top frame without any wrapping frames.
Reason and prerequisites
To exploit the cross-site framing vulnerability, the following conditions must be met: a user navigates to a malicious site that embeds the SAP E-Sourcing application within a frame (this can happen by following a link or visiting a spoofed site), and the user is using Microsoft Internet Explorer.
The vulnerability is limited to keyboard events, where malicious JavaScript can capture keystrokes and send them to an attacker.
Full note on SAP: SAP Support Launchpad note 1262354
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].