Whitelist based Clickjacking Framing Protection in UI theme designer on ABAP, SAP security note 2349128

SAP security note 2349128, "Whitelist based Clickjacking Framing Protection in UI theme designer on ABAP", is a program error note released on 11.10.2016. Below are the symptom, reason and prerequisites and SAP recommended solution.

Description

Symptom

UI theme designer on ABAP does not protect its applications against Clickjacking attacks.

Solution

Standard protection measures against Clickjacking (such as the X-FRAME-OPTIONS header) are not suitable for common NetWeaver integration scenarios. Therefore, SAP provides a whitelist-based framework for NetWeaver technologies. This framework and its implementation are detailed in SAP Note 2319727. This SAP Note specifically addresses the UI theme designer on ABAP.

Reason and prerequisites

Clickjacking is a UI-redressing attack where an attacker tricks a user into clicking on something different than the user is aware of. This attack leverages standard possibilities in HTML and does not exploit weaknesses in the application’s code.

References

• 2319727 – Clickjacking protection framework in SAP Netweaver AS ABAP and AS Java
• 2142551 – Whitelist service for Clickjacking Framing Protection in AS ABAP