SAP Security Note
Medium priority
SAP security note 1577412, “HTTP Verb Tampering Issue in UMEADMIN”, released on March 13, 2012. Below are the symptom and SAP recommended solution.
Description
Symptom
In UMEADMIN, there are problems with authorization and authentication checks if certain HTTP methods are used. An attacker can control the behavior of the system, or potentially escalate privileges by executing malicious code, without having legitimate credentials.
Solution
This issue has been fixed, and unused HTTP methods are now forbidden.
Reason and prerequisites
The UMEADMIN SPML service application contains HTTP verb tampering vulnerabilities. This means that there is a risk of information disclosure or data tampering if an attacker accesses the application using HTTP requests that contain unexpected HTTP methods.
Prerequisites: Never assign “SAP_ungranted_role” to any user. Ensure that SAP Note 1445998 is implemented to disable InvokerServlet (not required for SAP NetWeaver 7.20 SP03 and above). While HTTP verb tampering and InvokerServlet problems and solutions are not prerequisites of each other, it is recommended to implement both fixes.
Full note on SAP: SAP Support Launchpad note 1577412
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].