Securing SAP Systems from XSS vulnerabilities Part 3: Defense for SAP NetWeaver J2EE

From the developer’s perspective

For AS Java, the encoding is available as tc_sec_csi.jar. There is a static class and an interface which provides the encodings for HTML/XML, JavaScript, CSS and URL. Also it is available to use methods of public class StringUtils (com.sap.security.core.server.csi.util.StringUtils):

escapeScriptEndTag(String pStr) - Prepare a string to be used for a javascript string definition with particular care about script tag;
escapeScriptEndTag(StringBuffer sb, String pStr)- Prepare a string to be used for a javascript string definition with particular care about script tag.
escapeSpace(String input) - Encode a space with + Note that this function will call 'disableScriptSignatures'.
escapeToAttributeValue(String input) - Encode a string for output as an attribute string of a tag, no URLs!
escapeToAttributeValue(StringBuffer sb, String input, int maxLength) - Encode a string for output as an attribute string of a tag, no URLs!
escapeToAttributeValue(String input, int maxLength) - Encode a string for output as an attribute string of a tag, no URLs!
escapeToHTML(String input) - Encode a string for output between tags (CASE1)
escapeToHTML(StringBuffer sb, String input, int maxLength) - Encode a string for output between tags (CASE1)
escapeToHTML(String input, int maxLength) - Encode a string for output between tags (CASE1)
escapeToJS(String input) - Encode a string inside a JS string declaration (CASE5)
escapeToJS(StringBuffer sb, String input, int maxLength) - Encode a string inside a JS string declaration (CASE5)
escapeToJS(String input, int maxLength) - Encode a string inside a JS string declaration (CASE5)
escapeToURL(String input) - Encode a string that represents a URL (CASE3) Note that this function will call 'disableScriptSignatures'.
escapeToURL(StringBuffer sb, String input, int maxLength) - Encode a string that represents a URL (CASE3) Note that this function will call 'disableScriptSignatures'.
escapeToURL(String input, int maxLength) - Encode a string that represents a URL (CASE3) Note that this function will call 'disableScriptSignatures'.
urlEncode(String s) - A trivial replacement of URLEncoder.encode
urlEncode(StringBuffer sb, String s, char[] forceEncode) - This is an extended version of the URLEncoder.encode method.
urlEncode(String s, char[] forceEncode) - This is an extended version of the URLEncoder.encode method.

CASE1 (Output BETWEEN tags)

<head>
<title>[CASE1]</title>
</head>
<table>
<tr>
<td>Username</td>
<td>[CASE1]</td>
</tr>
</table>

CASE2 (Output INSIDE tags, but output is not a URL)

<form name="CASE2">
<input type="text" name="user" value="[CASE2]">
<input type="text" name="user" value='[CASE2]'>
</form>
<a name="[CASE2]">Click here</a>

CASE3 (Output is a URL)

CASE4 (Output inside a SCRIPT context, but output is not a string declaration)

CASE5 (Output is a string declaration in a script)

The class name is XSSEncoder (class name with package name: com.sap.security.core.server.csi.XSSEncoder).

The interface is IXSSEncoder(interface with package name: com.sap.security.core.server.csi.IXSSEncoder). The interface can be retrieved with com.sap.security.core.server.csi.XSSEncoder.getInstance().

The class XSSEncoder and the interface IXSSEncoder are the successors of the class StringUtils (see SAP Security Note 866020 [10] and its update Note 1601461 [11]), so the same dependencies have to be fulfilled, for example, a runtime reference to the J2EE library security.class or tc/bl/security/lib and a compiler reference to tc_sec_csi.jar.

Context Method

HTML / XML	out = XSSEncoder.encodeHTML( in ) and XSSEncoder.encodeXML( val );
JavaScript	out = XSSEncoder.encodeJavaScript( val );
URL	out = XSSEncoder.encodeURL( val );
CSS	out = XSSEncoder.encodeCSS( val );

For information about the delivery of these extensions, see SAP Security Note 1590008 [12].

WebDynpro Java

For WebDynpro Java, you do not have to care about XSS. The security is ensured through the framework itself.

SAP UI Development Kit for HTML5

For the SAP UI Development Kit for HTML5, the encoding functions are implemented as a jQuery plug-in in framework/_core/src/main/js/jquery.sap.encoder.js.

The functions to use for the different contexts are:

HTML / XML	jQuery.sap.encodeHTML(sValue) and jQuery.sap.encodeXML(sValue)
JavaScript	jQuery.sap.encodeJS(sValue)
URL	jQuery.sap.encodeURL(sValue)
CSS	jQuery.sap.encodeCSS(sValue)

From the administrator’s perspective

The administrator has to set the parameters to improve security:

Global_app_config/session_config/sessionTimeout = 900. Enable session timeout to minimize potential attack window.
SystemCookiesDataProtection = true. Declaring a cookie as HttpOnly increases the security of your system because it eliminates access to this cookie in the Web browser from client-side scripts, applets, plugins, and the like. Set httpOnly flag to secure cookies from transmitting them into the malicious host using XSS vulnerability.
ume.logon.httponlycookie= True. Logon tickets are cookies that are used for user authentication and Single Sign-On in J2EE Engine. Value “True” means that the session information can be transmitted only by HTTP and obtaining of cookies using document.cookie (typical example of XSS attack) is not possible.
SessionIPProtectionEnabled = True. Specifies whether the session IP protection is enabled. When this property is set to true, the HTTP session cannot be accessed from different IPs. Only requests from the IP that started the session are processed.

From incident response perspective

To be able to identify the real attack happened because of the XSS vulnerability and also from some other web-based vulnerabilities, it is recommended to configure the following parameters.

LogCLF = TRUE in configuration file http.properties enables logging in CEF format.
ArchiveOldLogFiles = ON. The Log Configurator service provides an option for automatic archiving of log files. Logs are written into a set of files. When the last file is completed, the new logs start overwriting the old log files. If there is no archiving for access logs, all logs soon will be overwritten.
Enable Additional information logging [13].
HttpTrace= Enable. To enable HTTP Trace for more information run ConfigTool. Open the Properties tab of the HTTP Provider Service running on the dispatcher and assign the appropriate value to the HttpTrace property.

All Articles