CRM ECO. Security – Invoker Servlet, SAP security note 1488846

SAP security note 1488846, "CRM ECO. Security – Invoker Servlet", is a program error note released on 14.12.2010. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

The Invoker Servlet feature allows HTTP clients to invoke arbitrary servlets even if they are not defined in the web.xml file of the application. Each web application has a default servlet mapping /servlet/* mapped to the Invoker Servlet provided by the web container. This servlet can load any servlet by name or class, which means requests like /<context-root>/servlet/<servlet-name-or-class> can invoke the specified servlet. This poses a security risk as end users can invoke application servlets that the application does not intend to expose. For example, if an application contains a buggy servlet that isn’t declared in its web.xml, clients can still invoke it without requiring authentication. NetWeaver will disable the Invoker Servlet to mitigate this risk.

Solution

This note provides Java Correction(s) for E-Commerce/Web Channel. The application should avoid relying on the Invoker Servlet feature and instead use local servlets defined explicitly in its own web.xml file. This change can typically be made entirely within the application’s web.xml.

Development components where web.xml was adjusted:

• SAP-SHRWEB: crm/isa/web/shopadmin, crm/isa/web/isauseradm, crm/ipc/web/ipc, crm/isa/web/catalogtool, crm/isa/web/catalog, crm/isa/web/b2c, crm/isa/web/b2b, crm/isa/web/auctionb2x, crm/isa/web/auctionebay
• SAP-CRMWEB: crm/isa/web/sharedcatalog, crm/isa/web/partnerregistration, crm/isa/web/lwc, crm/isa/web/imsadmin, crm/isa/web/entitlementinquiry, crm/isa/web/cviews, crm/icss/web/icss_b2c, crm/icss/web/icss_b2b, crm/eservice/web/insp_b2b, crm/eservice/web/cr_b2b

References

• 1598246: Servlet declaration missing for LWC SOAP Dispatcher servlet
• 1467771: Disabling invoker servlet in the portal
• 1445998: Disabling invoker servlet

Affected components

• SAP-CRMJAV: 5.0, 5.2, 6.0, 700, 701
• SAP-CRMWEB: 5.0, 5.2, 6.0, 700, 701
• SAP-SHRWEB: 5.0, 5.2, 6.0, 700, 701
• SAP-SHRJAV: 5.0, 5.2, 6.0, 700, 701
• SAP-CRMAPP: 5.0, 5.2, 6.0, 700, 701
• SAP-SHRAPP: 5.0, 5.2, 6.0, 700, 701