Whitelist based Clickjacking Framing Protection in Web Dynpro ABAP, SAP security note 1872800

SAP security note 1872800, "Whitelist Based Clickjacking Protection in Web Dynpro ABAP", is a note. Below are the symptom and SAP recommended solution.

Description

Symptom

Web Dynpro ABAP does not protect its applications against Clickjacking attacks.

Solution

SAP provides a whitelist-based framework for Clickjacking protection in NetWeaver technologies, as the standard X-FRAME-OPTIONS header is not suitable for common NetWeaver integration scenarios. This framework is detailed in SAP Note 2319727. For Web Dynpro ABAP, follow the steps below to implement the necessary protections.

• Update Unified Rendering: refer to SAP Note 2090746 for updating the Unified Rendering version of your system; see also SAP Note 2299529 – How to update Unified Rendering for Web Dynpro ABAP.
• Create Message in SE91: use transaction SE91 to create message number 031 in message class WEBDYNPRO_RT with the text “ICF service for Clickjacking Framing Protection is not active”, and enable Self-Explanatory for this message.
• Activation of Protection: add at least one entry into table HTTP_WHITELIST with ENTRY_TYPE=30; for detailed instructions, refer to SAP Note 2142551.

Reason and prerequisites

Clickjacking is a UI-redressing attack where an attacker tricks a user into clicking on something different than intended. This attack leverages standard HTML capabilities without exploiting code weaknesses in the application.

References

• 2319727 – Clickjacking protection framework in SAP Netweaver AS ABAP and AS Java
• 2142551 – Whitelist service for Clickjacking Framing Protection in AS ABAP
• 2090746 – Unified Rendering Update