Skip links
RedRays - Your SAP Security Solution
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

SAP Security on Udemy

Disabling Invoker Servlet in Tomcat, SAP security note 1511415

SAP Note 1511415SAP Security NoteHigh priority

SAP security note 1511415, "Disabling Invoker Servlet in Tomcat", is a note released on December 14, 2010. Below are the symptom and SAP recommended solution.

ComponentIS-R-TRN-EFT (Industry-Specific Components > Industry-Specific Component Retail > Transnet > Transnet Centralized EFT)
PriorityCorrection with high priority
TypeSAP Security Note
StatusReleased for Customer
Released onDecember 14, 2010

Description

Symptom

You want to disable the default servlet mapping /servlet/* to prevent accessing servlets via a different path anonymously, regardless of the security constraints defined in the web.xml.

Solution

  • Upgrade Tomcat to a version that fixes the Invoker Servlet issue (i.e., v4.0.6, v4.1.3, or newer).
  • Inform existing customers using old versions of Tomcat to upgrade.

Reason and prerequisites

A vulnerable feature in the Tomcat Web Container prior to v4.0.6 and v4.1.3 allows invocation of special URLs that cause servlet execution. This method does not obey the rules defined in the web.xml.

References

Full note on SAP: SAP Support Launchpad note 1511415

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Invoker Servlet#InvokerServlet#Direct access to servlets#Unauthorized access to servlets

Explore More