Cross-Frame Scripting protection in logon application, SAP security note 1651004

SAP security note 1651004, "Cross-Frame Scripting protection in logon application," is a note released on 28.03.2013. Below are the symptom and the SAP recommended solution.

Description

Symptom

This security note addresses a vulnerability where the SAP logon application can be abused by an attacker. This allows unauthorized access to data entered by a legitimate user across different pages of the logon application.

Solution

• Apply Latest Patches: Ensure that you apply the latest patches relevant to your Web AS Java release as outlined in the Patch Level section of this note. You can download the necessary patches here.
• Configure UME Property: Update the UME property login.block_ext_logon_app_embedding to true to enhance protection against XFS attacks.

Reason and prerequisites

Cross-frame scripting (XFS) exploits browser vulnerabilities to access information entered manually by users on web pages. Although the Web AS Java is not directly vulnerable to XFS attacks, it is recommended to implement additional defenses in web applications as a precautionary measure. The impact of XFS attacks on SAP systems is considered low to moderate, primarily because most supported browsers have addressed this vulnerability.

References

• Update 2 to Security Note 1651004
• Update 1 to Security Note 1651004