Whitelist Service API required for the Clickjacking Framing Protection in JAVA at the framework or application level, SAP security note 2286679

SAP security note 2286679, "Whitelist Service API required for the Clickjacking Framing Protection in JAVA at the framework or application level". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

Frameworks and Applications on the NetWeaver Java platform require the configuration needed to call the whitelist clickjacking service. This configuration allows the application to validate the server’s configuration for protection against clickjacking.

Solution

Standard protection measures like the X-FRAME-OPTIONS header are insufficient for common NetWeaver integration scenarios. SAP provides a whitelist-based framework for NetWeaver technologies, detailed in SAP Note 2319727.

Key Methods Provided:

• getDefaultConfigParams(HttpServletRequest request): Provides configurable parameters for the custom protection script.
• getDefaultProtection(HttpServletRequest request): Provides the default protection script.
• getCustomProtection(HttpServletRequest request, ClickJackingProtectionConfiguration contentData): Provides a custom protection script using configurable parameters.
• isClickjackingProtectionEnabled(): Indicates whether clickjacking protection is enabled.

A new configuration parameter is introduced in SAP Note 2493715, with updated documents to accommodate the new settings.

The clickjacking/check servlet determines the activation of clickjacking protection in SAP NetWeaver AS for Java. Refer to SAP Note 2170590 for servlet availability across different releases and service packs.

Reason and prerequisites

Clickjacking is an attack that leverages standard HTML features without exploiting vulnerabilities in the application code. More details can be found at the OWASP Clickjacking page.

CVSS

Score 4.3 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

References

• Additional Configuration Parameter for Clickjacking Service Configuration
• Clickjacking protection framework in SAP Netweaver AS ABAP and AS Java
• Whitelist service for Clickjacking Framing Protection in AS JAVA

Affected components

• LM NWA UI FRAMEWORK and Lifecycle Management Tools, including 7.00 up to 7.50, with specific support packages and patches