SAP Security Note
HotNews
SAP security note 2798336, "[CVE-2019-0355] Code Injection vulnerability in SAP NetWeaver AS for Java (Web Container)", is a program error note released on September 10, 2019. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
The Application Server Java Web Container allows an attacker to inject code that can be executed by the application. This vulnerability can lead to:
- Unauthorized execution of commands
- Sensitive information disclosure
- Denial of Service
Solution
Content validation has been enhanced to fix the code injection vulnerability. Update your Application Server Java to a Support Package (SP) or release where the issue is resolved. See the Support Packages & Patches section of this SAP Note for details and available patches.
Reason and prerequisites
A program error in the default implementation of the PUT method in HTTP 1.1 allows bypassing input validation checks, resulting in the upload of web dynamic content.
CVSS
Score 9.1 Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
References
Affected components
- ENGINEAPI: 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50
- SAP-JEECOR: 6.40, 7.00, 7.01 to 7.02
Full note on SAP: SAP Support Launchpad note 2798336
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].