HTTP WhiteList Check (security), SAP security note 853878

SAP security note 853878, “HTTP Whitelist Check (security)”. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

A Cross-Site Scripting (XSS) attack is possible by supplying a bogus themeRoot to an HTTP application, such as any BSP application, that references the external themeRoot without verifying that the pointed theme is safe.

Problem Description: There are situations where a framework or application on the ABAP server receives information from external sources that it potentially uses in interactions with the browser. Externally received information could point to untrusted websites. For example:

/myApplication?use-css-file=http://company.portal.com/ourTheme.css

If the application does not validate the use-css-file, a malicious URL like:

/myApplication?use-css-file=http://unknown.com/full.JavaScript.css

could lead the browser to execute unknown JavaScript code.

Solution

Updates and Corrections

• Minor Correction: Added security features to validate that URLs do not contain carriage return or linefeed sequences. Completed the exception raise code. Applicable to support packages 620SP54-56, 640SP14, and 700SP05.
• HTTP Table Update: In support packages 620SP58, 640SP16, and 700SP07, the HTTP table has been updated to include a unique sort sequence in the key, allowing multiple entries pointing to the same host with different URLs.
• Whitelist Infrastructure: A whitelist infrastructure has been added to the HTTP framework (supported in 620SP54, 640SP14, and 700SP03). This whitelist allows configuring patterns that are matched against URLs from external sources to verify acceptance.

Configuration

The whitelist is stored in the HTTP_WHITELIST table and can be updated via transaction SE16.

Example Whitelist Entries:

• protocol=*, host=*.myDomain.myExt, port=*, url=*
• protocol=http, host=myPortal.myDomain.myExt, port=1080, url=/*
• protocol=https, host=myPortal.myDomain.myExt, port=1443, url=/*

Developer Notes: Use the function CL_HTTP_UTILITY->CHECK_HTTP_WHITELIST to utilize the whitelist. If the check fails, the exception CX_HTTP_WHITELIST is raised.

Entry Types:

• CL_HTTP_UTILITY->HTTP_WHITELIST_EP_CSS_URL
• CL_HTTP_UTILITY->HTTP_WHITELIST_SAP_EXITURL
• CL_HTTP_UTILITY->HTTP_WHITELIST_WDA_RESUME_URL

Reason and prerequisites

It is not possible to verify an externally received themeRoot URL.

CVSS

Score 0

References

• BSP Security Relevant Changes
• Whitelist checks of sap-exit URL
• SSO for local BSP calls from SAPGUI HTML control
• BSP: HTTP Allowlist Check fails for port entries
• Composite SAP Note: HCM Authorizations Documentation
• Composite SAP Note: XSS Documentation

Affected components

• SAP_BASIS: Versions 620 to 640, 700, 710