SAS Web Infrastructure Platform applications, including SAS Logon Manager, might be vulnerable to Cross-Site Request Forgery (CSRF) attacks.

CVSS Score: 6.0

Click the Hot Fix tab in this note to access the hot fix for this issue.

Important Notes:

The application of this hot fix provides a filter for protection against CSRF in the SAS^® installation. The filter is disabled by default to allow you the opportunity to configure it before it is enabled, which avoids potential user impact upon enablement.

With this protection enabled, requests that do not originate from sites that belong to a whitelist are rejected. By default, the implications of this change are that the SAS installation is secure against browser-based CSRF attacks and applications that are external to the SAS installation cannot link to SAS web applications. If you link to a SAS application from a company intranet or a portal page that is not hosted in the SAS installation, you encounter access denied messages when you click those links.

There are many legitimate cases where it is necessary to link to SAS web applications. For such cases, you can add a site that contains a link to a SAS web application to the SAS CSRF whitelist, as follows:

1. Launch SAS^® Management Console.
2. Select Application Management ► Configuration Manager.
3. Open the properties for SAS Application Infrastructure.
4. On the Advanced tab, add a property named sas.web.csrf.referers.knownHosts and specify the value as a comma-delimited list of whitelisted sites. For example, to enable my-intranet.example.com and test.my-intranet.example.com to the whitelist, set the value to http://my-intranet.example.com/,http://test.my-intranet.example.com/.

Including a trailing slash at the end of each value is important because omitting the slash means that sites can use a prefix attack to bypass the protections. Be sure to include port numbers in the value if the whitelisted site uses ports other than the standard 80 or 443 for HTTP and HTTPS, respectively. You can also restrict a value to an application on the whitelisted site by including the application’s path in the value, for example, http://my-intranet.example.com/my-application-path/.

A fix for this issue for SAS Portal and Portlets 4.31_M2 is available at:

A fix for this issue for Search Interface to SAS Content 3.4 is available at:

A fix for this issue for Search Interface to SAS Content 3.5 is available at:

A fix for this issue for SAS Visual Analytics 7.2 is available at:

A fix for this issue for SAS Visual Analytics 7.1 is available at:

A fix for this issue for SAS Middle Tier 9.4_M2 is available at:

A fix for this issue for SAS Management Console 9.4_M2 is available at:

A fix for this issue for SAS Middle Tier 9.3_M2 is available at: