SAP security note 1555523, “WebGUI Java applet security redesign”. Below are the symptom and SAP recommended solution.
Description
Symptom
SAP WebGUI allows users to emulate SAP GUI within a browser, enabling SAP transactions through a web interface. It utilizes a trusted Java Applet for local operations such as file uploads/downloads, program execution, and file/directory management. To enhance security, SAP has redesigned this Java applet to ensure it operates strictly within a SAP environment. Users must now explicitly trust the applet’s origin, reinforcing security by requiring the SAP cryptographic library (SAP cryptolib) to be installed on the SAP application server or the standalone ITS 6.20. Failure to properly install this library will trigger a "Security warning" popup, advising users to contact their system administrator.
Solution
1. Apply Support Packages and Kernel Patches: Ensure all relevant support packages and SAP kernel patches are applied. Refer to the Support Package section for specific patch URLs matching your system’s software component version.
2. Update Configuration Files: Modify the WEBGUI.CFG file to manage white lists and black lists for file operations. This file should be located in the configuration directory:
- Windows: %APPDATA%\WEBGUI_CFG_DIR
- Other OS: user.home/WEBGUI_CFG_DIR
Example configurations:
- Allow file downloads to C:\downloads:
FILE_DOWNLOAD_ALLOWED=C:\downloads - Allow specific file extensions:
FILE_EXECUTE_EXTENSIONS_ALLOWED=cfg;hwl
3. Manual Corrections: After installing the necessary patches, manually add a new row in the IACFL table:
- Field NAME: ITSUPDOWNNEWSYNC
- Field MANDATORY: Leave empty
CVSS
Score 6.8 Vector: AV:N/AC:M/AU:N/C:P/I:P/A:P
Full note on SAP: SAP Support Launchpad note 1555523
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].