ClickJacking vulnerability in WebDynpro Java, SAP security note 1781171

SAP security note 1781171, “ClickJacking Vulnerability in WebDynpro Java”. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

A clickjacking vulnerability exists in any WebDynpro Java application, allowing attackers to trick users into performing unintended actions.

Solution

SAP has introduced two new framework attributes to mitigate this vulnerability:

• ClickJacking: Set this attribute to true to enable protection against clickjacking.
• X-FRAME-OPTIONS: Defines how the content can be embedded in frames. Options include DENY (disallows any framing), SAMEORIGIN (allows framing only from the same origin), and ALLOW-FROM domain.com (allows framing from the specified domain, note browser limitations).

Implementation steps:

• Configure the ClickJacking attribute to true in the application settings.
• Set the X-FRAME-OPTIONS attribute according to your security requirements.

To resolve this vulnerability, apply the relevant WebDynpro for Java patch. You can download the patch using the Download for SNOTE link or the PDF Version link.

Reason and prerequisites

Any WebDynpro Java (WD Java) application is susceptible to this ClickJacking vulnerability.

CVSS

Score 6.8 Vector: AV:N/AC:M/AU:N/C:P/I:P/A:P

References

Affected components

• SAP_JTECHS: 6.40, 7.00 – 7.02
• SAP_JTECHF: 6.40, 7.00 – 7.02
• WD-RUNTIME: 7.10 – 7.40
• FRAMEWORK: 7.10 – 7.40