SAP security note 1541855, “Verb Tampering Issues in SAP NetWeaver PI”, is a note. Below are the symptom and SAP recommended solution.
Description
Symptom
Problems with authorization and authentication checks in conjunction with different HTTP methods used might exist in PI Runtime Workbench.
Solution
The described security issue is fixed in the following (and newer) Support Packages:
- 7.10 SP14
- 7.11 SP09
- 7.20 SP07
- 7.30 SP03
For older Support Packages, the correction is available as a patch. Please update the software components of the Adapter Engine to the patch levels maintained in the section “SP Patch Level” of this note or use newer versions.
Reason and prerequisites
PI Runtime Workbench might contain Verb Tampering vulnerabilities. This means that there is a risk of information disclosure and/or data tampering if the application is accessed with HTTP requests containing unexpected HTTP methods.
References
Full note on SAP: SAP Support Launchpad note 1541855
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
