SAP security note 2319172, “Whitelist based Clickjacking Framing Protection in SAP GUI for HTML”. Below are the symptom and SAP recommended solution.
Description
Symptom
SAP GUI for HTML does not protect its applications against Clickjacking attacks.
Solution
Standard protection measures against Clickjacking (X-FRAME-OPTIONS header) are not suitable for common NetWeaver integration scenarios. Therefore, SAP is providing a whitelist-based framework for NetWeaver technologies.
This framework and its implementation are described in SAP Note 2319727.
This SAP Note provides the solution for SAP GUI for HTML.
Additionally, correction instructions are supplied via this SAP Note.
Reason and prerequisites
Clickjacking is an UI-redressing attack where an attacker tricks a user into clicking on something different than the user is aware of. This attack leverages standard possibilities in HTML and does not exploit weaknesses in the application code.
Further details can be found at OWASP Clickjacking.
References
- SAP Note 2319727 – Clickjacking protection framework in SAP Netweaver AS ABAP and AS Java
- SAP Note 2207791 – SAP GUI for HTML: Whitelist-Service zur Clickjacking Framing Protection
- SAP Note 2142551 – Whitelist service for Clickjacking Framing Protection in AS ABAP
Full note on SAP: SAP Support Launchpad note 2319172
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].