Filtering HTTP TRACE requests in AS Java, SAP security note 1473116

SAP security note 1473116, "Filtering HTTP TRACE requests in AS Java", is a consulting note released on 08.06.2010. Below are the symptom, SAP recommended solution and affected software components.

Description

Symptom

This note addresses the need to reject HTTP TRACE requests in the Internet Communication Manager (ICM) to prevent session attacks using the TRACE method defined in RFC2616.

Solution

• Using NW 7.20 Kernel (Patch Level 40 or Higher): the kernel automatically filters out HTTP TRACE requests for AS Java and responds with HTTP "403 Forbidden" to such requests. To deactivate this filter, set the profile parameter icm/HTTP/ASJava/allow_trace_method = TRUE.
• If the kernel does not contain the change, configure a filter in ICM: edit the profile file (e.g., DEFAULT.PFL) to include the modification handler icm/HTTP/mod_0 = PREFIX=/,FILE=$(DIR_GLOBAL)/security/data/icm_filter_rules.txt, then create icm_filter_rules.txt in the specified directory with the rule If %{REQUEST_METHOD} stricmp "TRACE" RegForbiddenUrl ^/(.*) -, and restart the ICM to apply the new settings.

Reason and prerequisites

The TRACE method can be exploited for session attacks. To enhance security, it's essential to reject HTTP TRACE requests in ICM.

References

• 1422175 – How to disable the HTTP TRACE requests

Affected components

• SAP_BASIS: Versions 710 to 720