SAP security note 1445998, "Disabling Invoker Servlet". Below are the symptom, SAP recommended solution, reason and prerequisites, and references.
Description
Symptom
- You want to disable the default servlet mapping
/servlet/*. - Servlets can be accessed anonymously via different paths regardless of security constraints defined in the
web.xml. Servlets that are not declared in theweb.xmlat all can also be accessed successfully.
Solution
The Invoker Servlet has been disabled by default in version 7.20 (in the patch levels described in the SP Patch Level section) and in the initial shipment of version 7.30 of the Engine. For these versions, apply the following steps:
- Upgrade to the latest version of SAP Java Engine. Refer to the SP Patch Level section of this SAP Note for details.
- Identify whether any requested scenarios rely on the Invoker Servlet.
For all other versions, additionally:
- Disable the vulnerable feature by setting the
EnableInvokerServletGloballyproperty of theservlet_jspservice on the server nodes tofalse.
Refer to the attached PDF for detailed identification and mitigation steps.
Reason and prerequisites
A vulnerable feature in the Web Container allows invocation of special URLs that cause servlet execution. This method does not obey the rules defined in the web.xml.
References
- SAP Note 1802092: PDF display error due to invoker servlet disabled in NW 7.3
- SAP Note 1625314: HTTP verb tampering issue in BRMS-CORE
- SAP Note 1624360: HTTP verb tampering issue in DI_DTR
- SAP Note 1624182: HTTP verb tampering issue in CBS
- SAP Note 1623895: Missing authentication check in Usage Types Viewer
- SAP Note 1617369: Verb Tampering issues in CMS
- SAP Note 1616259: Briefing at Black Hat conference on August 4th, 2011
- SAP Note 1611873: Verb Tampering issues in CM Services
- SAP Note 1598246: Servlet declaration missing for LWC SOAP Dispatcher servlet
- SAP Note 1590689: PI SEC: HTTP verb tampering issue in AF Application
- SAP Note 1537663: Biller Direct, Security – Invoker Servlet
- SAP Note 1535301: Invoker Servlet Fix for IS-M/AMC
- SAP Note 1511415: Disabling Invoker Servlet in Tomcat
- SAP Note 1488846: CRM ECO. Security – Invoker Servlet
- SAP Note 1467771: Disabling invoker servlet in the portal
- SAP Note 1463661: Open SQL monitors: Servlets cannot be loaded
- SAP Note 1460635: RWB link "Index Administration" shows error 403 – forbidden
- SAP Note 1423130: Central Note for Portal Platform in SAP NW7.0 EhP1 SP6
- SAP Note 1373989: SAP NetWeaver Portal Platform NW701, EhP1 SP5
- SAP Note 1299552: SAP NetWeaver Portal Platform NW701, EhP1 SP4
- SAP Note 1258416: SAP NetWeaver Portal Platform NW701, EhP1 SP3
Full note on SAP: SAP Support Launchpad note 1445998
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].