URL Redirection vulnerability in URL and Generic iView, SAP security note 2323727

SAP security note 2323727, "URL Redirection vulnerability in URL and Generic iView". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

The URL and Generic iViews allow an attacker to redirect users to a malicious site due to insufficient URL validation. This vulnerability can lead to:

• Phishing attacks to steal victims’ credentials.
• Redirection to untrusted webpages containing malware or similar malicious exploits.

Solution

To address this vulnerability, apply the relevant Support Package (SP) patch level. Additionally, perform the following manual activities in each system where the Note is implemented:

• Enable Whitelist for URL Redirect: open the service AllowedResourceUrlsService located inside the com.sap.portal.ivs.httpservice application, set "Enable Whitelist For URL Redirect" to true, and configure "Allowed Redirect URL Prefixes" with the allowed URL prefixes (protocol, domain and port required; wildcards not allowed; use port 80 for URLs without a port). Save and restart the service.
• Configure Portal Services: for EP 7.0x see Configure Portal Services for EP 7.0x; for EP >= 7.1x see Configure Portal Services for EP >= 7.1x.

Reason and prerequisites

Program Error.

References

• Causes side effects with SAP Note 2609421: HTTPRenderLayer_Redirect.jsp fails to compile
• 2332266: SAP NetWeaver 7.30 SP17 – Composition Platform
• 2332236: SAP NetWeaver 7.30 SP17 – EP Core – Application Portal
• 2463570: SAP NetWeaver 7.31 SP20 – Composition Platform

Affected components

• EP-RUNTIME (7.00 to 7.50)
• EP-ADMINISTRATION (7.10 to 7.50)
• EP-PSERV (7.00 to 7.02)