SAP security note 1963932, "Missing encryption for form based authentication", is a note. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
In cases where a HANA XS-based application is configured to enforce encrypted access, a non-encrypted form-based authentication might occur instead.
Solution
- For HANA Revision 70 and later: The system behavior has been improved to forward encrypted authentication requests to an encrypted form-based login, even if the form-based login component isn’t explicitly configured with the Force SSL option.
- For Revisions Prior to 70: Set the Force SSL option using the XS admin tool:
- Navigate to the XS administration tool at https://<host>:<XS port>/sap/hana/xs/admin/index.html.
- Locate the form-based login application object at the path sap.hana.xs.formLogin.
- Enable Force SSL for the form-based login component.
Reason and prerequisites
A HANA XS-based application can be configured to accept only encrypted requests by enabling the Force SSL option. If unauthenticated users access the application, they are redirected to the form-based login component (if configured). Without the Force SSL setting on the form-based login, authentication might occur without encryption. After successful authentication, users are redirected back to the application with encryption enforced.
CVSS
Score 2.9 Vector: AV:A/AC:M/AU:N/C:P/I:N/A:N
Affected components
- HDB 1.00
Full note on SAP: SAP Support Launchpad note 1963932
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
