ITS620 check global service in URL, SAP security note 883908

SAP security note 883908, “ITS620: check global service in URL”, is released on 08.10.2009. Below are the symptom and SAP recommended solution.

Description

Symptom

ITS 6.20 allows disabling services using the ITS admin tool. When a service is disabled, it cannot be accessed by users. However, there’s an issue with disabling the technical service global. This service is typically non-callable and only serves to provide global information inherited by other services. If a user attempts to access the URL http://host.domain:port/scripts/wgate/global/!, the logon page appears. While this might be an unwanted behavior for customers who disable all unused services, it doesn’t pose a significant security risk as an attacker cannot perform more actions than what is possible on any ITS logon page.

Solution

With ITS 6.20 patch 20, the ability to call the global service is blocked, resolving the issue described above.