Whitelist based Clickjacking Framing Protection in FSCM Biller Direct, SAP security note 2339167

SAP security note 2339167, "Whitelist-based Clickjacking Framing Protection in FSCM Biller Direct", is a note released on July 12, 2016. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

FSCM Biller Direct running on JSP technology is not protected against Clickjacking attacks.

Solution

Standard protection measures against Clickjacking (X-FRAME-OPTIONS header) are not suitable for common NetWeaver integration scenarios.

SAP provides a whitelist-based framework for NetWeaver technologies, detailed in SAP Note 2319727.

This SAP Note provides the solution for FSCM Biller Direct.

For custom applications based on JSP running on SAP NW JAVA, refer to the attached document to adapt the impacted custom applications.

Activating Clickjacking Protection:

• Open XCM using the URL https://your_server:your_server_port/bd/admin/xcm/init.do
• Navigate to General Application Settings > Customer > Application Security > application_security_config
• Configure the Clickjacking settings: clickjacking.active is the main switch to activate/deactivate clickjacking protection; clickjacking.whiteList is a comma-separated list of trusted hostnames, where $AUTO includes the host where the application runs and an empty value prompts configuration in the Clickjacking Whitelist Configuration of SAP NetWeaver Administrator
• Save the configuration
• Use the XCM Clickjacking protection test to verify prerequisites; protection is available only if the test is successful

Reason and prerequisites

Clickjacking is an UI-redressing attack where an attacker tricks a user into clicking on something different from what the user perceives. It leverages standard HTML capabilities without exploiting application code weaknesses.

Prerequisites:

• SAP Note 2170590 – Enable and configure ClickJacking solution in SAP NetWeaver Java Server
• SAP Note 2263656 – Enable the ClickJacking protection in HTMLB Java

References

• 2327541 – Configuring Clickjacking protection in Web Channel / E-Commerce applications
• 2263656 – Whitelist based Clickjacking Framing Protection in HTMLB Java
• 2170590 – Whitelist service for Clickjacking Framing Protection in AS JAVA

Affected components

• FSCM Biller Direct versions 600, 602, 604, 605, 635