HTTP verb tampering issue in CBS, SAP security note 1624182

SAP security note 1624182, “HTTP Verb Tampering Issue in CBS”, is a note. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

In CBS, there are problems with authorization and authentication checks if certain HTTP methods are used. An attacker can control the behavior of the system, or potentially escalate privileges by executing malicious code, without having legitimate credentials.

Solution

Apply the official patch for the respective release from the Service Market Place.

Reason and prerequisites

CBS contains HTTP verb tampering vulnerabilities. This means that there is a risk of information disclosure or data tampering if an attacker accesses the application using HTTP requests that contain unexpected HTTP methods.

• "SAP_ungranted_role" shall never be granted to any user.
• Ensure SAP Note 1445998 is applied to disable invokerservlet (Not required for NW 7.20 SP03 and above). While Verb-Tampering and InvokerServlet problems and solutions are not prerequisites of each other, we still recommend both fixes.

References

• SAP Note 1445998 – Disabling invoker servlet

Affected components

• DI_CBS (6.40, 7.00 to 7.02, 7.10 to 7.11, 7.20, 7.30, 7.31)
• SAP_DEVINF (6.40)