SAP Security Note
Medium priority
SAP security note 2221657, "Code injection vulnerability in SAP Internet Communication Manager", is a program error note released on 12.04.2016. Below are the symptom and SAP recommended solution.
Description
Symptom
SAP Internet Communication Manager (ICM) contains code that enables the execution of arbitrary program code of the user’s choice. An attacker can control system behavior or escalate privileges by executing malicious code without legitimate credentials.
Solution
Enable input validation for the HOST field of HTTP requests by setting the profile parameter icm/HTTP/allow_invalid_host_header to FALSE using transaction RZ11. This validation checks for duplicate HOST fields and syntactically incorrect values. Invalid requests are rejected with HTTP Code 400.
The solution is delivered with the patch level mentioned in this SAP Note.
References
Full note on SAP: SAP Support Launchpad note 2221657
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].