Invoker Servlet Fix for IS-M/AMC, SAP security note 1535301

SAP security note 1535301, "Invoker Servlet Fix for IS-M/AMC". Below are the symptom and SAP recommended solution.

Description

Symptom

Via the so-called Invoker Servlet feature, HTTP clients are able to invoke arbitrary servlets even if not defined in the web.xml file of the application. Each web application gets a default servlet mapping /servlet/* which is mapped to the Invoker Servlet provided by the web container. This servlet may load an arbitrary servlet by servlet name or servlet class. As a result, all requests in the following pattern: /<context-root>/servlet/<servlet-name-or-class> lead to the invocation of the servlet <servlet-name-or-class>. Via this feature, application servlets may be invoked by end users although the application is not willing to provide them (security attacks). For example, if a web application contains a buggy servlet but hasn't declared it in its web.xml file (because it is buggy!), the clients are still able to invoke it. In addition, by default, there is no authentication needed to invoke these servlets. The Invoker Servlet will be disabled by NetWeaver.

Solution

The application shall not rely on the Invoker Servlet feature but use local servlets, i.e., defined in its own web.xml file only. In general, the change can be done entirely in the web.xml file of the application (no code changes required). For all servlets the application accesses through the /servlet/ prefix, define appropriate servlet-mapping. For example, if you have a URL http://host/myContextRoot/servlet/myServlet, then you need to define the following servlet-mapping tag:

<servlet-mapping>
  <servlet-name>myServlet</servlet-name>
  <url-pattern>/servlet/myServlet/*</url-pattern>
</servlet-mapping>

The Invoker Servlet issue is fixed in the AMC Web Editor Demo Application starting from the following AMC versions:

• AMC 2.0 applet version 180
• AMC 3.0 applet version 163

The modified web.xml files are listed below:

• Software Component ISM-AMC-WB, Development Components: /is/ism/amc/web/client, /is/ism/amc/web/monitor
• Software Component ISM-AMC-WE, Development Components: /is/ism/amc/web/editor/servlet

Since the fix is similar in these files, here is the content of one web.xml file as an example:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE web-app PUBLIC "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN" "http://java.sun.com/dtd/web-app_2_3.dtd">
<web-app>
  <display-name>WEB APP</display-name>
  <description>WEB APP description</description>
  <servlet>
    <servlet-name>WebEditorServlet</servlet-name>
    <servlet-class>com.sap.ism.amc.web.editor.server.WebEditorServlet</servlet-class>
  </servlet>
  <servlet-mapping>
    <servlet-name>WebEditorServlet</servlet-name>
    <url-pattern>/servlet/WebEditorServlet/*</url-pattern>
  </servlet-mapping>
</web-app>

References