Skip to Content
author's profile photo Sarah Bavousett
Sarah Bavousett

Portal 7.31 Logon Page Clickjacking Vulnerability Question

Posted on Jan 19, 2016 at 10:43 PM 224 Views

Portal 7.31 Logon Page Clickjacking Vulnerability Question Our Internal Security has flagged our Portal Logon Page as having the Possibility of Clickjacking Vulnerability. Security have stated the following: The web server does not set an X-Frame-Options response header in all content responses. This could potentially expose the site to a clickjacking or UI Redress attack wherein an attacker can trick a user into clicking an area of the vulnerable page that is different than what the user perceives the page to be. This can result in a user performing fraudulent or malicious transactions. Note that while the X-Frame-Options response header is not the only mitigation for clickjacking, it is currently the most reliable method to detect through automation. I thought SAP handled Clickjacking thru the coding of JSP’s but I cannot find any documentation to show our Security people I would like to know if and how SAP handles clickjacking in the Portal Logon Page? I would like to know if it is possible and how I would change the Portal Logon Page to include X-Frame-Options Any help on this matter would be greatly appreciated Thank you Sarah

SAP Enterprise Portal Security
Add comment
10|10000 characters needed characters exceeded

2 Answers

  • author's profile photo JEGANRAJ R
    JEGANRAJ R
    Posted on Aug 30, 2016 at 07:43 AM

    Hi Sarah,

    Please refer the note 2319727. SAP has given the steps to be performed in case of ABAP and JAVA for Clickjacking.

    Regards,

    Jegan Raj

    Add comment
    10|10000 characters needed characters exceeded

    • Former Member
      Aug 30, 2016 at 08:23 AM

      Nice one Jeganraj, thanks for sharing. Especially linked 2169722 is containing an important clue from my point of view:

      "...Standard protection measures against Clickjacking (X-FRAME-OPTIONS header) are not suitable for common NetWeaver integration scenarios.

      Therefore SAP is providing a whitelist based framework for NetWeaver technologies..."

      Indeed, the 2319727 doesnt contains any specific informations, but rather is pointing to W3C etc... As I have mentioned you will need a concrete scenario, to be able to advise concrete measures

      cheers

  • author's profile photo Heather Korycinski
    Heather Korycinski
    Posted on Aug 25, 2016 at 02:42 PM

    Hello,

    We are experience similar issue with 7.3 and 7.4. Did you get any reply or update on this?

    Thanks

    Heather

    Add comment
    10|10000 characters needed characters exceeded

    • Former Member Stefan Mahnke
      Aug 30, 2016 at 07:35 AM

      Stefan, this is in fact another story imho, since you already obviously understood what the problem exactly is and how to avoid it. What you have here are problems on know how for SAP web dispatcher. From your problem description Im not clear what is meant with "but it didn't worked". I would suggest you to take a look here e.g.: How to Configure SAP Web Dispatcher as Reverse Proxy for SAP CRM or SAP ECC using HANA Cloud Integration resp describe your problems in the right section of SCN: your question is in fact an infrastructure question and is barely related to EP.

      However, Im still not clear what your exact scenario is, since no one in this thread is describing the exact problem resp. a reproducing sequence

      cheers