SAP Internet Communication Framework fails to validate HTTP_WHITELIST, SAP security note 2189853

SAP security note 2189853, “SAP Internet Communication Framework fails to validate HTTP_WHITELIST”, is a note released on July 14, 2020. Below are the symptom and SAP recommended solution.

Description

Symptom

This SAP Security Note addresses an issue in the SAP Internet Communication Framework (ICF) where public services fail to validate the Access Control List (ACL) information in the table HTTP_WHITELIST and do not log out users correctly. Specifically, in public services, SAP ICF was validating the ACL against client "000" instead of the target client and performing logout operations in client "000" instead of the target client. This behavior inadvertently allowed open access to public services across all clients and could cause session contexts to persist longer than expected.

Solution

The correction ensures that SAP ICF validates the ACL against the HTTP_WHITELIST of the target client rather than client "000". Additionally, logout operations are now correctly performed in the target client.

Before applying this correction, verify that the configuration of the HTTP_WHITELIST table in target clients (other than client "000") aligns with your security requirements to prevent unintended access.

CVSS

Score 5.0 Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L