Skip links

Disabling invoker servlet, SAP security note 1445998

Description

  • You want to disable default servlet mapping “/servlet/*”
  • Servlets can be accessed via a different path anonymously regardless of security constraints defined in the web.xml. Servlets that are not declared in the web.xml at all can also be accessed successfully.

Available fix and Supported packages

  • ENGINEAPI | 7.10 | 7.11
  • ENGINEAPI | 7.20 | 7.20
  • EP-PSERV | 6.0_640 | 6.0_640
  • EP-BASIS | 7.10 | 7.11
  • EP-BASIS | 7.20 | 7.20
  • EP-BASIS | 7.30 | 7.30
  • SAP-JEECOR | 7.00 | 7.00
  • SAP-JEECOR | 6.40 | 6.40
  • SAP-JEECOR | 7.01 | 7.02
  • SERVERCORE | 7.10 | 7.10
  • SERVERCORE | 7.11 | 7.11
  • SERVERCORE | 7.20 | 7.20
  • EPBC | 7.00 | 7.02
  • ENGINEAPI 7.10 | SP009 | 000006
  • ENGINEAPI 7.10 | SP010 | 000004
  • ENGINEAPI 7.10 | SP011 | 000000
  • ENGINEAPI 7.10 | SP012 | 000000
  • ENGINEAPI 7.11 | SP003 | 000008
  • ENGINEAPI 7.11 | SP004 | 000009
  • ENGINEAPI 7.11 | SP005 | 000005
  • ENGINEAPI 7.11 | SP006 | 000000
  • ENGINEAPI 7.11 | SP007 | 000000
  • ENGINEAPI 7.20 | SP001 | 000005
  • ENGINEAPI 7.20 | SP002 | 000007
  • ENGINEAPI 7.20 | SP003 | 000003
  • ENGINEAPI 7.20 | SP004 | 000000
  • J2EE ENGINE SERVERCORE 7.10 | SP009 | 000019
  • J2EE ENGINE SERVERCORE 7.10 | SP010 | 000012
  • J2EE ENGINE SERVERCORE 7.10 | SP011 | 000000
  • J2EE ENGINE SERVERCORE 7.11 | SP003 | 000022
  • J2EE ENGINE SERVERCORE 7.11 | SP004 | 000017
  • J2EE ENGINE SERVERCORE 7.11 | SP005 | 000010
  • J2EE ENGINE SERVERCORE 7.11 | SP006 | 000000

Affected component

    BC-JAS-WEB
    Web Container, HTTP, JavaMail, Servlets

CVSS

Score: 0

Exploit

Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.

URL

https://launchpad.support.sap.com/#/notes/1445998

TAGS

#/servlet/*
#Invoker-Servlet
#InvokerServlet
#Web-Container
#J2EE-engine
#direct-access-to-servlets
#unauthorized-access-to-servlets

How to detect over 4100 vulnerabilities in SAP Systems?

More to explorer

Initiating SAP Penetration Testing

►   Pentest, short for penetration testing, refers to a set of processes that simulate an attacker’s actions to identify security vulnerabilities. Companies