SAP security note 2319192, "Whitelist based Clickjacking Framing Protection in BSP", is a note. Below are the symptom and SAP recommended solution.
Description
Symptom
BSP framework does not protect its applications against Clickjacking attack.
Solution
Standard protection measures against clickjacking (X-FRAME-OPTIONS header) are not suitable for common Netweaver integration scenarios. Therefore, SAP provides a whitelist-based framework for Netweaver technologies.
This framework and its implementation are described in SAP Note 2319727.
This note provides the BSP part.
IMPORTANT: The Clickjacking protection works only if the HTML page contains the <head></head> tags. Ensure these tags are present on the page; otherwise, Clickjacking protection cannot be applied.
Reason and prerequisites
Clickjacking is a UI-redressing attack where an attacker tricks a user into clicking on something different than the user is aware of. This attack exploits standard functionalities in HTML and does not rely on weaknesses in the application code.
Further details can be found at OWASP Clickjacking.
References
- SAP Note 2319727 – Clickjacking protection framework in SAP Netweaver AS ABAP and AS Java
- SAP Note 2142551 – Whitelist service for Clickjacking Framing Protection in AS ABAP
Full note on SAP: SAP Support Launchpad note 2319192
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].