Whitelist based Clickjacking Framing Protection in Solution Sales Configuration, SAP security note 2335687

SAP security note 2335687, "Whitelist based Clickjacking Framing Protection in Solution Sales Configuration", is a program error note released on 22.09.2016. Below are the symptom, SAP recommended solution and CVSS score.

Description

Symptom

Solution Sales Configuration running on Java Server Pages (JSP) technology is not protected against Clickjacking attacks.

Solution

Standard Protection Measures. Standard protection measures against Clickjacking (X-FRAME-OPTIONS header) are not suitable for common NetWeaver integration scenarios. Therefore, SAP provides a whitelist-based framework for NetWeaver technologies. This framework and its implementation are detailed in SAP Note 2319727. This note offers the solution for Solution Sales Configuration.

Custom Applications. If you have any custom applications based on JSP technology running on SAP NW JAVA, refer to the attached PDF in this note for guidance on extending the current clickjacking protection to your custom applications.

Configuration Steps. Configure as per the proposed solution in SAP Note 2166717 in CRM to use the SSC application with CRM.

Manual Configuration. Refer to SAP note 2327541 for configuring Clickjacking protection.

Reason and prerequisites

Clickjacking is a UI-redressing attack where an attacker tricks a user into clicking on something different than what the user perceives, leveraging standard HTML features without exploiting vulnerabilities in the application’s code. More details can be found at OWASP Clickjacking.

Prerequisites: SAP note 2170590 – Enable and configure Clickjacking solution in SAP NetWeaver Java Server; SAP note 2263656 – Enable the Clickjacking protection in HTMLB Java; SAP Note 2166717 – Clickjacking Protection in BSP.

CVSS

Score 0

References