SAP security note 2319174, "Whitelist based Clickjacking Framing Protection in NWBC for HTML", is a note released on 19.10.2017. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
NWBC for HTML does not protect its applications against Clickjacking attacks.
Solution
Standard protection measures against Clickjacking (X-FRAME-OPTIONS header) are not suitable for common NetWeaver integration scenarios. Therefore, SAP provides a whitelist-based framework for NetWeaver technologies. This framework and its implementation are detailed in SAP Note 2319727. This SAP Note specifically addresses NWBC for HTML.
Reason and prerequisites
Clickjacking is a UI-redressing attack where an attacker tricks a user into clicking on something different than the user is aware of. This attack leverages standard possibilities in HTML and does not exploit weaknesses in the application’s code. Further details can be found at OWASP Clickjacking.
References
- 2319727 – Clickjacking protection framework in SAP Netweaver AS ABAP and AS Java
- 2148130 – SAP NWBC ABAP Runtime Patch 45
- 2142551 – Whitelist service for Clickjacking Framing Protection in AS ABAP
Affected components
- SAP_UI 740 to 752
- SAP_BASIS 700-702, 711, 730, 731
Full note on SAP: SAP Support Launchpad note 2319174
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].