SAP Security Note
High priority
SAP security note 1629878, "AS Java allows flash access from any domain", is a customizing note released on 14.02.2012. Below are the symptom, SAP recommended solution and reason and prerequisites.
Description
Symptom
SAP NetWeaver Application Server Java (AS Java) allows Web clients (such as Adobe Flash Player, Adobe Acrobat, and others) to handle data across domains.
Solution
The solution makes the default configuration most restrictive, not permitting content provided by external domains to access resources from AS Java. Web applications deployed on AS Java can still deploy their specific policy files, granting external domains access to their resources. This access is limited only to the scope of application resources.
Apply the patches specified in the Support Package Patches section of this SAP Note.
Reason and prerequisites
AS Java has a configuration that allows Web clients to handle data across domains. When a client hosts content provided by a different domain, the configuration checks if AS Java trusts the domain to consume content deployed on AS Java. The default configuration is least restrictive, granting permissions for content from any domain to access resources from AS Java. This default configuration is vulnerable to XSRF (CSRF) attacks.
References
Full note on SAP: SAP Support Launchpad note 1629878
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].