SAP security note 1512081, “CLOCO – GANTT is not displayed II”, is a program error note released on 14.12.2010. Below is the security information published by SAP for this note.
Description
Symptom
You are working with the Closing Cockpit. When you try to display the Gantt chart, the system issues various error messages (for example, java.lang.NullPointerException) and does not display the Gantt chart.
Reason and prerequisites
The security-relevant system profile parameter icf/set_HTTPonly_flag_on_cookies has been activated (icf/set_HTTPonly_flag_on_cookies = 0) for the ABAP application server. Due to this parameter, the HttpOnly indicator is set for system cookies. As a result, applets can no longer access these cookies.
The repository of the Gantt chart is stored in a non-public storage location. Access is denied.
Solution
1. Implement Note 1420203. 2. Implement the attached corrections. 3. In transaction SICF, create the following service under /SAP/PUBLIC/BusinessSuite:
- Name: CloCo
- Description: Closing Cockpit
- Handler: CL_HTTP_EXT_WEBDAV_PUBLIC
Then, activate the service.
References
- Note 1532777 – Collective Note: ABAP Session Protection Recommendations
- Note 1420203 – Enable foreign access to a stateful HTTP session
Full note on SAP: SAP Support Launchpad note 1512081
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
