SAP security note 2169860, "Whitelist based Clickjacking Framing Protection in Web Dynpro Java", is a note. Below are the symptom and SAP recommended solution.
Description
Symptom
Web Dynpro Java does not protect its applications against Clickjacking attacks.
Solution
Standard protection measures against Clickjacking (X-FRAME-OPTIONS header) are not suitable for common NetWeaver integration scenarios.
Therefore SAP is providing a whitelist based framework for NetWeaver technologies.
This framework and its implementation are described in SAP Note 2319727.
This SAP Note provides the part for Web Dynpro Java (WDJ).
WDJ applications can be protected from the clickjacking vulnerability by following Whitelist enabling for JAVA in SAP Note 2170590.
If the “ClickJackingProtection” parameter value was customized before applying the patch from the SAP Note then it is required to manually change the “ClickJackingProtection” parameter value to the default ones i.e. false.
There is another solution to secure the Web Dynpro Java applications from clickjacking vulnerability which is mentioned in SAP Note 1781171.
The solution provided in SAP Note 1781171 is purely browser specific and was not allowing to whitelist multiple hosts for framing the WD Java applications. Since the solution from SAP Note 1781171 is a browser specific feature, SAP has no control over the attribute X-Frame-Options values added in the server response which is used to control the framing of the Web Dynpro Java application.
But the whitelist service solution mentioned in this SAP Note is not browser specific and allows whitelisting of multiple hosts so that Web Dynpro Java can be framed on any whitelisted hosts and SAP has full control over the framing logic.
Either of the solutions could be used but both solutions must not be used together.
We strongly suggest to use the whitelist service solution mentioned in this SAP Note.
Reason and prerequisites
Clickjacking is a UI-redressing attack where an attacker tricks a user to click something different than the user is aware of. This attack makes use of standard possibilities in HTML and does not use weaknesses in the code of the application.
Full note on SAP: SAP Support Launchpad note 2169860
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
