Disabling execution of operating system commands using a CTC URL, SAP security note 1963100

SAP security note 1963100, "Disabling execution of operating system commands using a CTC URL", is a security note. Below are the symptom and SAP recommended solution.

Description

Symptom

It is possible to execute any operating system commands using a CTC URL where it should not be allowed.

Solution

Apply the official patch for the respective release from the Service Market Place to disable the command invocation using a URL automatically.

Please also implement SAP security note 1445998 if not already done.

Reason and prerequisites

The CTC application contains a vulnerability where any operating system command can be executed on an AS Java host using NWA credentials through a URL invocation. Typically, this requires authentication using NWA credentials. If you have not already implemented SAP security note 1445998, then this can be done without authentication using NWA credentials.

CVSS

Score 9.0 Vector: AV:N/AC:L/AU:S/C:C/I:C/A:C

References

• SAP Note 1445998 – Disabling invoker servlet