SAP security note 2263656, "Whitelist-based Clickjacking Framing Protection in HTMLB Java", is a note. Below are the symptom and SAP recommended solution.
Description
Symptom
HTMLB does not protect its applications against Clickjacking attacks.
Solution
Standard protection measures against Clickjacking (X-FRAME-OPTIONS header) are not suitable for common NetWeaver integration scenarios. Therefore, SAP provides a whitelist-based framework for NetWeaver technologies. This framework and its implementation are detailed in SAP Note 2319727.
This SAP Note specifically addresses HTMLB. Apply the note to deploy this feature on the J2EE server.
Reason and prerequisites
Clickjacking is an UI-redressing attack where an attacker tricks a user into clicking on something different than the user is aware of. This attack leverages standard HTML features and does not exploit weaknesses in the application’s code.
Full note on SAP: SAP Support Launchpad note 2263656
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].