Bypass of Filter in SAP Internet Communication Manager, SAP security note 2104357

SAP security note 2104357, "Bypass of Filter in SAP Internet Communication Manager." Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

An authenticated user can use functions of SAP Internet Communication Manager and SAP Web Dispatcher to which access should be restricted. This may result in an escalation of privileges.

URL Filters of SAP Internet Communication Manager and SAP Web Dispatcher can be bypassed using a specifically crafted URL.

Solution

Please apply the patch level of SAP Kernel (executables) mentioned in this SAP Note.

Reason and prerequisites

SAP Internet Communication Manager and SAP Web Dispatcher do not contain authorization checks for verifying an authenticated user’s authorization to access certain functions. This may result in undesired system behavior.

Additionally, SAP Internet Communication Manager and SAP Web Dispatcher fail to map all URLs with the filter definition. Consequently, the request will be forwarded to the SAP application server, where authentication occurs.

Affected components

• BC-CST-IC: SAP KERNEL 7.21 to 7.43 (both 32-bit and 64-bit, including Unicode variants)