HTTP verb tampering issue in DI_DTR, SAP security note 1624360

SAP security note 1624360, “HTTP verb tampering issue in DI_DTR”, is a note. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

In DTR, there are problems with authorization and authentication checks if certain HTTP methods are used. An attacker can control the behavior of the system, or potentially escalate privileges by executing malicious code, without having legitimate credentials.

Solution

Apply the official patch for the respective release from the Service Market Place.

Reason and prerequisites

DTR contains HTTP verb tampering vulnerabilities. This means that there is a risk of information disclosure or data tampering if an attacker accesses the application using HTTP requests that contain unexpected HTTP methods.

• "SAP_ungranted_role" shall never be granted to any user.
• Ensure SAP Note 1445998 is applied to disable invokerservlet (Not required for NW 7.20 SP03 and above). While Verb-Tampering and InvokerServlet problems and solutions are not prerequisites of each other, we still recommend both fixes.

Affected components

• DI_DTR (versions 6.40 to 7.31)
• SAP_DEVINF (version 6.40)
• SAPDEVINFF (version 6.40)