Skip links
RedRays - Your SAP Security Solution
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

SAP Security on Udemy

Extended security settings for sapstartsrv, SAP security note 1439348

SAP Note 1439348

SAP security note 1439348, "Extended security settings for sapstartsrv", is a note. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

  • The SAPControl Webservice interface allows reading of system information without requiring user authorization.
  • Unprotected methods can be exploited to gather system configuration details.

Solution

  1. Protect Additional Webservice Methods:
    • For Kernel Releases 7.38 and 8.00+: Set service/protectedwebmethods = SDEFAULT in the default profile. Restart all sapstartsrv instances to apply changes.
    • For Earlier Releases: Implement the relevant sapstartsrv or kernel patch: 640 patch 337, 700 patch 263, 701 patch 101, 710 patch 208, 711 patch 93, 720 patch 45. Ensure all SAP MMC installations are updated to at least patch level 59 to maintain compatibility.
  2. Set Up Single Sign-On (SSO):
    • Requires SAP SSL configuration on all system instances.
    • Activate HTTPS in the SAP MMC "Security" properties.
    • Configure client certificates for authentication.
    • Define permitted administrators using profile parameters like service/sso_admin_user_0.
  3. Restrict Network Access:
    • Limit remote access to ports 5XX13 / 5XX14 of sapstartsrv agents.
    • Allow communication only between necessary systems and authorized Webservice clients.
    • Use profile parameters service/http/acl_file and service/https/acl_file to specify network ACL lists.
    • Restart sapstartsrv after making changes.

Reason and prerequisites

  • sapstartsrv differentiates between protected and unprotected Webservice methods.
  • By default, methods that change the system status (e.g., start/stop/restart) are protected, while many informational methods remain unprotected.
  • Information exposed by unprotected methods can reveal unsecured configurations.

References

Affected components

  • SAP_BASIS Kernel releases 6.40 SP337, 7.00 SP263, 7.01 SP101, 7.10 SP208, 7.11 SP093, 7.20 SP045, 7.38 and above, 8.00 and above
  • MMC version 7.20

Full note on SAP: SAP Support Launchpad note 1439348

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#sapstartsrv #SAPControl Webservice #Kernel Patch #SSO

Explore More