Skip links
RedRays - Your SAP Security Solution
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

SAP Security on Udemy

CVE-2019-0327 Unrestricted File Upload vulnerability in SAP NetWeaver AS Java (Web Container), SAP security note 2777910

SAP Note 2777910
SAP Security Note
Medium priority

SAP security note 2777910, "[CVE-2019-0327] Unrestricted File Upload vulnerability in SAP NetWeaver AS Java (Web Container)", is a program error note released on 09.07.2019. Below are the symptom and the SAP recommended solution.

ComponentBasis Components > NetWeaver Application Server Java > Web Container, HTTP, JavaMail, Servlets
CategoryProgram error
PriorityMedium priority
TypeSAP Security Note
Version10
StatusReleased for Customer
Released on09.07.2019
LanguageEnglish

Description

Symptom

AS Java Web Container allows an attacker to upload files (including script files) without proper file format validation.

Some well-known impacts of Unrestricted File Upload vulnerability are:

  • Malicious file insertion or modification
  • Making the website vulnerable to other attacks such as Cross-Site Scripting (XSS)

Solution

To disable the default Web Container HTTP 1.1 PUT method implementation, update your AS Java to a Support Package (SP) or release where the functionality is turned off. Refer to the "Support Packages & Patches" section of this SAP Note for details and available patches.

For previous releases, you can manually disable the functionality by following KBA 1975430 – How to disable PUT method for Java Engine Web Container.

Enabling the default Web Container HTTP 1.1 PUT method implementation is not recommended. Applications requiring PUT method functionality should implement their own doPut() method within the servlet, ensuring proper file format validation and appropriate user authorization. Please refer to the Servlet 2.5 API for more details on implementing the doPut() method and corresponding security constraints.

Reason and prerequisites

The AS Java Web Container provides a default implementation of the PUT method of HTTP 1.1. The Web Container offers default protection for this method, allowing only the Administrator group of users to perform PUT requests. PUT method configuration is defined in the global-web.xml deployment descriptor.

CVSS

Score 5.9 Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

References

Full note on SAP: SAP Support Launchpad note 2777910

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Upload of untrusted files #File upload vulnerability #SAP NetWeaver AS Java (Web Container) #CVE-2019-0327

Explore More