Whitelist service for Clickjacking Framing Protection in AS ABAP, SAP security note 2142551

SAP security note 2142551, "Whitelist service for Clickjacking Framing Protection in AS ABAP". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

SAP Note 2142551 addresses a critical security vulnerability related to Clickjacking in SAP NetWeaver Application Server (AS) ABAP. UI technologies in AS ABAP were previously unprotected against Clickjacking attacks, allowing malicious actors to trick users into unintended actions within the application.

Clickjacking is a UI redressing attack where an attacker overlays transparent frames over legitimate application content, manipulating user interactions without their knowledge. This exploitation leverages standard HTML features without relying on flaws within the application’s code.

Solution

SAP introduces a whitelist-based framework to mitigate Clickjacking attacks across NetWeaver technologies. The framework involves configuring trusted parent origins that are allowed to embed SAP applications within frames.

• Create Required Packages: Use transaction SE80 to create the following packages: SUICS for UI Core Services within both SAP_BASIS and SAP_UI software components.
• Configure ICF Services: Service “uics”: Path /sap/bc/uics. Service “whitelist”: Path /sap/bc/uics/whitelist, assign handler CL_UICS_WHITELIST_CHECK. External Alias: Path /sap/public/bc/uics/whitelist pointing to /sap/bc/uics/whitelist, configure logon data with a system user having no permissions.
• Maintain HTTP_WHITELIST Table Entries: Set ENTRY_TYPE to 30 to activate Clickjacking protection. Define trusted PROTOCOL, HOST, PORT, and set URL to *.
• Activate Services: Ensure all newly created ICF services are activated via transaction SICF.

CVSS

Score 4.3 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

References

• SAP Note 2319727 – Clickjacking protection framework in SAP NetWeaver AS ABAP and AS Java
• OWASP Clickjacking

Affected components

• SAP_BASIS: Versions 700 to 731
• SAP_UI: Versions 740, 750