A note with CVSS 4.7 for component BC-FES-ITS was released by SAP on 09.02.2021. The correction/advisory 2973428 was described with "Reverse Tabnabbing vulnerability within SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML)" and affects the system type Kernal.
A workaround does not exist, according to SAP Security Advisory team. It is advisable to implement the correction as monthly patch process.
The vulnerability addressed is reverse tabnabbing within Kernal.
Reverse tabnabbing is an attack where a page linked from the target page is able to rewrite that page, for example
to replace it with a phishing site. The following figure shows a brief illustration:
While the user was originally on the correct page there is a high risk they will not notice that it has been changed to a phishing site.
Risk specificationSAP GUI for HTML allows an unauthenticated remote attacker to redirect users to a malicious site due to insufficient reverse tabnabbing URL validation.
The solution impacts the method 'cl_gui_html_viewer'. Therefore, to resolve the issue the most current SAPEXE SAR for your kernel needs to be installed.
The advisory is valid for
- KERNEL 7.22
- KERNEL 7.49 4
- KERNEL 7.53 4
- KERNEL 7.73 2
- KERNEL 7.77 2
- KERNEL 7.81
- KRNL32NUC 7.22 3
- KRNL32NUC 7.22EXT 3
- KRNL32UC 7.22 3
- KRNL32UC 7.22EXT 3
- KRNL64NUC 7.22 3
- KRNL64NUC 7.22EXT 3
- KRNL64NUC 7.49 4
- KRNL64UC 7.22 3
- KRNL64UC 7.22EXT 3
- KRNL64UC 7.49 4
- KRNL64UC 7.53
- KRNL64UC 7.73 2
- 4.7 [CVE-2021-21478] Reverse Tabnabbing vulnerability in SAP NetWeaver Application Server ABAP (Applications based on Web Dynpro ABAP)
- 4.7 [CVE-2021-21491] Reverse TabNabbing vulnerability in SAP NetWeaver Application Server Java (Applications based on Web Dynpro Java)
- 4.7 Reverse TabNabbing vulnerability in SAP NetWeaver Application Server Java (Applications based on HTMLB for Java)
- 4.7 Reverse tabnabbing issue in Unified Rendering based frameworks in NetWeaver Application Server Java
- 4.1 Reverse Tabnabbing vulnerability within SAP CRM WebClient UI