Whitelist based Clickjacking Framing Protection in Utility Customer E-Services, SAP security note 2339506

SAP security note 2339506, "Whitelist based Clickjacking Framing Protection in Utility Customer E-Services", is a note released on 12.07.2016. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

Utility Customer E-Services running on JSP technology is not protected against Clickjacking attacks.

Solution

Standard protection measures against Clickjacking (X-FRAME-OPTIONS header) are not suitable for common NetWeaver integration scenarios. Therefore, SAP provides a whitelist-based framework for NetWeaver technologies. This framework and its implementation are detailed in SAP Note 2319727.

This SAP Note offers the solution for Utility Customer E-Services (UCES).

If you have custom applications based on JSP technology running on SAP NW JAVA, follow the attached document to adapt the impacted custom applications.

Manual steps to activate Clickjacking protection:

• Open XCM by navigating to http(s)://your_server:your_server_port/bdisu/admin/xcm/init.do
• Navigate to General Application Settings > Customer > Application_security > application_security_config
• Configure the Clickjacking settings: clickjacking.active is the main switch to activate or deactivate clickjacking protection; clickjacking.whiteList is a comma-separated list of hosts for a whitelist, where $AUTO is replaced with the host where the application is running and an empty value prompts the clickjacking service to use the whitelist configured in the Clickjacking configuration of SAP NetWeaver Administrator
• Save the configuration to apply the changes
• Use the XCM Clickjacking protection test to verify that all prerequisites are met; protection is only available if the test is successful

Reason and prerequisites

Clickjacking is an UI-redressing attack where an attacker tricks a user into clicking on something different than what the user perceives. This attack exploits standard HTML functionalities without relying on application code vulnerabilities.

Prerequisites:

• SAP Note 2170590 – Enable and configure ClickJacking solution in SAP NetWeaver Java Server
• SAP Note 2263656 – Enable the ClickJacking protection in HTMLB Java

References

• SAP Note 2339167

Affected components

• SAP-UCES versions 6.02, 6.04, 6.05, 6.35