SAP security note 1778940, "HTTP verb tampering issue in SAP_JTECHS", is a note. Below are the symptom, SAP recommended solution and affected software components.
Description
Symptom
In SAP_JTECHS, there are problems with authorization and authentication checks if certain HTTP methods are used for the URL http://host:port/usmm.
An attacker can determine whether certain components are being used that may be subject to a license without having legitimate credentials.
Solution
Apply the patch provided in SAP Security Note 1778940.
Additional Recommendations:
- Do not assign the SAP_ungranted_role to any user.
- Implement SAP Note 1445998 to disable InvokerServlet (not required for SAP NetWeaver 7.20 Support Package 03 and higher).
While HTTP verb tampering and InvokerServlet issues are not prerequisites of each other, implementing both fixes is recommended for enhanced security.
Reason and prerequisites
SAP_JTECHS contains HTTP verb tampering vulnerabilities. This poses a risk of information disclosure or data tampering if an attacker accesses the application using HTTP requests with unexpected methods.
CVSS
Score 4.3 Vector: AV:N/AC:M/AU:N/C:N/I:P/A:N
Affected components
- SAP-JEE: 6.40
- SAP_JTECHS: 7.00 to 7.02
Full note on SAP: SAP Support Launchpad note 1778940
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].