HTTP verb tampering issue in SAP_JTECHS, SAP security note 1778940

SAP security note 1778940, "HTTP verb tampering issue in SAP_JTECHS", is a note. Below are the symptom, SAP recommended solution and affected software components.

Description

Symptom

In SAP_JTECHS, there are problems with authorization and authentication checks if certain HTTP methods are used for the URL http://host:port/usmm.

An attacker can determine whether certain components are being used that may be subject to a license without having legitimate credentials.

Solution

Apply the patch provided in SAP Security Note 1778940.

Additional Recommendations:

• Do not assign the SAP_ungranted_role to any user.
• Implement SAP Note 1445998 to disable InvokerServlet (not required for SAP NetWeaver 7.20 Support Package 03 and higher).

While HTTP verb tampering and InvokerServlet issues are not prerequisites of each other, implementing both fixes is recommended for enhanced security.

Reason and prerequisites

SAP_JTECHS contains HTTP verb tampering vulnerabilities. This poses a risk of information disclosure or data tampering if an attacker accesses the application using HTTP requests with unexpected methods.

CVSS

Score 4.3 Vector: AV:N/AC:M/AU:N/C:N/I:P/A:N

Affected components

• SAP-JEE: 6.40
• SAP_JTECHS: 7.00 to 7.02