CVE-2019-0391 Information Disclosure in SAP NetWeaver Application Server Java(eCATT service), SAP security note 2835226

SAP security note 2835226, "[CVE-2019-0391] Information Disclosure in SAP NetWeaver Application Server Java(eCATT service)". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

Under certain conditions, SAP NW AS Java allows an attacker to access information which would otherwise be restricted.

Some well-known impacts of Information Disclosure are:

• Loss of information and system configuration confidentiality
• Information gathering for further exploits and attacks

Solution

In corrected systems, the vulnerable service can now only be used from a logon with a user with dedicated authorizations.

Please note that if you want to use the ECATT framework for automation of applications built with Web Dynpro Java, you need to introduce authorizations and UME roles for the respective system to allow access to the service /ecatt/ecattping.

SAP recommends using this service only in test systems.

The authorization has to be implemented with the application role ecattadmin, which will appear as "action" in the user management of the SAP NW AS Java.

To be able to call the ecattping-service, user authentication is required with a user who has the action ecattadmin assigned by UME-role:

1. On the start page of SAP NetWeaver Application Server Java, open "User Management" > "Identity Management".
2. Add a new UME-role on the Java AS.
3. Assign a UME-action with the parameters: service="tc~ecattping~enterpriseap", name="ecattadmin" to that UME-role.
4. Create or change the user who should access /ecatt/ecattping and assign the new UME-role to the user.

Reason and prerequisites

Missing implementation of authorization checks for a service.

CVSS

Score 4.3 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

Affected components

• FRAMEWORK 7.10 to 7.11
• FRAMEWORK 7.20
• FRAMEWORK 7.30
• FRAMEWORK 7.31
• FRAMEWORK 7.40
• FRAMEWORK 7.50