SAP security note 1648138, "Insecure default configuration of ACLs in KM repositories", is a note. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
After installation, all KM repositories and their subfolders have the default permission Everyone: Full Control. Since all users belong to the Everyone-user-group by default, it may allow newly registered users to access and compromise the repositories and documents.
Solution
To restrict access to KM repositories and to secure content and configurations, appropriate permissions have to be assigned. A CTC configuration task assigns permissions to the following repositories:
- pccruntime
- pccshrcontent
- room_extensions
- room_publicarea_structures
- room_store_cm
- room_structures
- rooms
- runtime
- workflow
- attachment
The executions of the configuration for SAP NETWEAVER 7.30 can be found in the Knowledge Management section of the following link: Knowledge Management Configuration.
For other KM repositories see Note 1499993.
Manual solution for SAP NetWeaver 04, SAP NetWeaver 7.0, SAP EHP1 for SAP NetWeaver 7.0 and SAP EHP2 for SAP NetWeaver 7.0 is to apply the steps described in Note 599425.
Reason and prerequisites
The ACL’s configuration has insecure default configuration values after the initial installation of Enterprise Portal. This may result in undesired system behavior.
Affected versions:
- SAP NetWeaver 04
- SAP NetWeaver 7.0
- SAP EHP1 for SAP NetWeaver 7.0
- SAP EHP2 for SAP NetWeaver 7.0
CVSS
Score 6.5 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Affected components
- LM-PORTAL: 7.30, 7.31
- KMC-BC: 7.30, 7.31
- KMC-CM: 7.30, 7.31
Full note on SAP: SAP Support Launchpad note 1648138
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].