SAP security note 2169722, "Whitelist based Clickjacking Framing Protection in Enterprise Portal", is a note. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
Enterprise Portal does not protect its applications against Clickjacking attacks.
Solution
Standard protection measures against Clickjacking (X-FRAME-OPTIONS header) are not suitable for common NetWeaver integration scenarios.
Therefore, SAP is providing a whitelist-based framework for NetWeaver technologies.
This framework and its implementation are described in SAP Note 2319727.
This SAP Note provides the solution for Enterprise Portal.
Refer to the Support Package Patch Level tab and correction instructions for applying the fix.
Reason and prerequisites
Clickjacking is an UI-redressing attack where an attacker tricks a user into clicking on something different than the user is aware of. This attack leverages standard HTML capabilities and does not exploit weaknesses in the application's code.
Further details can be found at OWASP Clickjacking.
References
- SAP Note 2319727: Clickjacking protection framework in SAP Netweaver AS ABAP and AS Java
- SAP Note 2170590: Whitelist service for Clickjacking Framing Protection in AS JAVA
This document is causing side effects in SAP Note 2276701: BCM Not showing messages after upgrade.
Affected components
- EPBC2 7.00 – 7.02
- EP-BASIS 7.10 – 7.11
- EP-BASIS 7.20
- EP-BASIS 7.30
- EP-BASIS 7.31
- EP-BASIS 7.40
- EP-BASIS 7.50
- EP-RUNTIME 7.10 – 7.11
- EP-RUNTIME 7.20
- EP-RUNTIME 7.30
- EP-RUNTIME 7.31
- EP-RUNTIME 7.40
- EP-RUNTIME 7.50
- EPBC 7.00 – 7.02
Full note on SAP: SAP Support Launchpad note 2169722
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].