SAP security note 1513973, "Logon popup appears after logout and browser back". Below are the symptom and SAP recommended solution.
Description
Symptom
If you logout from WEBCUIF, e.g., in CRM 7.0, and you click browser back, you will get a logon popup instead of the system logon page. If you use this popup, it will not be possible to logout any longer.
Solution
Apply the corresponding support package or implement the correction instructions.
The fix will disable caching even if it is HTTPS.
Reason and prerequisites
The error is caused because the WEBCUIF start page is cached in the browser. When the user clicks browser back, the browser will not call the server but take the page from the browser cache. From there, it will load an additional resource from the server, which will result in the authentication popup (basic authentication) as no logon has been performed since logout. Basic authentication is always cached in the browser, and therefore it will not be possible to logout any longer.
The start page is set up to not be cached. This works well in HTTP but not in HTTPS. So the symptom will only occur with HTTPS.
Full note on SAP: SAP Support Launchpad note 1513973
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
