SAP security note 1457125, "Java Applet not working in cFolders". Below are the symptom and SAP recommended solution.
Description
Symptom
Java Applet not working in cFolders. Error describes "400 session not found".
Solution
Apply the correction available with this Note.
Reason and prerequisites
The security-relevant system profile parameter icf/set_HTTPonly_flag_on_cookies was activated for the ABAP application server (icf/set_HTTPonly_flag_on_cookies = 0). The HttpOnly flag will be set for system cookies as a result of this parameter.
The file upload and download functionality is not working in a secured environment. Note 1420203 must be implemented!
References
- 1658516 – Applets fail due to XSRF protection (COOKIE_NOT_FOUND)
- 1543682 – Java applet is not working for checkout scenario
- 1532777 – Collective Note: ABAP Session Protection Recommendations
- 1420203 – Enable foreign access to a stateful HTTP session
Full note on SAP: SAP Support Launchpad note 1457125
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
