SAP security note 1625893, “HTTP verb tampering issue in GP WSDLs”. Below are the symptom, SAP recommended solution and references.
Description
Symptom
In Guided Procedures (GP) WSDLs, there are problems with authorization and authentication checks if certain HTTP methods are used. An attacker can control the behavior of the system, or potentially escalate privileges by executing malicious code, without having legitimate credentials.
Solution
To correct this problem, apply the patch matching your support package version as listed in the patch table below as per the instructions in the NetWeaver Support Package Stack Guide.
Temporarily disable the affected function by stopping the following application: caf/eu/gp/model/web
Reason and prerequisites
Guided Procedures (GP) WSDLs contain HTTP verb tampering vulnerabilities. This means that there is a risk of information disclosure or data tampering if an attacker accesses the application using HTTP requests that contain unexpected HTTP methods. Never assign #SAP_ungranted_role to any user. Ensure that SAP Note 1445998 is implemented to disable InvokerServlet (not required for SAP NetWeaver 7.20 SP03 and above). While HTTP verb tampering and InvokerServlet issues are not prerequisites of each other, we still recommend both fixes.
References
- 1673397 – Release note for component GP-CORE for SAP NW CE 7.20 SP07
- 1666014 – Release note for component SAP-EU for NW 7.01 SP11
- 1659921 – Release note for component GP-CORE for NW 7.10 SP14
- 1658284 – Release note for component SAP-EU for NW 7.0 SP26
- 1653624 – Release note for component GP-CORE for SAP NW 731 SP02
- 1647620 – Release note for component SAP-EU for NW 7.02 SP10
Full note on SAP: SAP Support Launchpad note 1625893
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].