SAP Note 1471069
SAP security note 1471069, "Security Note – ABAP Security Sessions and SAML 2.0". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
A security vulnerability has been identified when using the AI iView in systems that have ABAP Security Sessions enabled (refer to SAP Note 1322944). This issue may allow an attacker to gain control over the client's PC. Currently, there is no workaround available; applying the provided fix is mandatory as no mitigations exist.
Solution
- Enable ABAP HTTP Security Sessions: Navigate to the portal system object and open it for editing. Go to the 'connector' section. Change the property ABAP HTTP Security Sessions Enabled to Yes.
- If Patch is Applied: The property ABAP HTTP Security Sessions Enabled might not appear in the property editor. Follow the manual steps outlined in the attached document update_system.doc contained within Update_System.zip.
WarningIf the ABAP HTTP Security Sessions feature is disabled in the back-end, ensure to reconfigure this property to No. Failure to do so will prevent sessions to the back-end from being terminated properly.
Affected components
- SAP NetWeaver 7.00 SP22 and earlier
- SAP NetWeaver 7.01 SP7 and earlier
- SAP NetWeaver 7.02 SP4 and earlier
- SAP NetWeaver 7.10 SP10 and earlier
- SAP NetWeaver 7.11 SP5 and earlier
- SAP NetWeaver 7.20 SP3 and earlier
- SAP NetWeaver 7.30 SP0
Full note on SAP: SAP Support Launchpad note 1471069
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
