J2EE Security vulnerability by unprotected HTTP PUT method, SAP security note 604285

SAP security note 604285, "J2EE: Security vulnerability by unprotected HTTP PUT method". Below are the symptom and SAP recommended solution.

Description

Symptom

• By default, there are no restrictions for the HTTP PUT method.
• Authentication is not required to upload a file.

Solution

1. Procedure for J2EE 6.20 SP1 – SP10

Restrict the HTTP PUT method in each web application deployed on your SAP J2EE Engine. Update the web.xml file of each application with the following security constraints:

<security-constraint>
    <web-resource-collection>
        <web-resource-name>Protected Area</web-resource-name>
        <http-method>PUT</http-method>
        <url-pattern>/*</url-pattern>
    </web-resource-collection>
    <auth-constraint>
        <role-name>$SAP_J2EE_Engine_default_put_role</role-name>
    </auth-constraint>
</security-constraint>
<login-config>
    <auth-method>BASIC</auth-method>
    <realm-name>Upload Protection</realm-name>
</login-config>
<security-role>
    <role-name>$SAP_J2EE_Engine_default_put_role</role-name>
</security-role>

Edit the web.xml file within the EAR file of your application, then update or redeploy the application using the deploy interface. Only changes in the web.xml file will be applied; other modifications on the local disk remain unaffected.

2. J2EE 6.20 SP11

Modify the global-web.xml file located at cluster\server\services\servlet_jsp\global-web.xml. Uncomment and activate the security constraint tags shown above, then restart the applications to apply the changes. For applications without a login-config in their web.xml, optionally add:

<login-config>
    <auth-method>BASIC</auth-method>
    <realm-name>Upload Protection</realm-name>
</login-config>

3. J2EE 6.20 SP12 and newer

The HTTP PUT implementation is disabled by default. If enabled via the HttpPutEnabled property, protect it as described for SP11: set the HttpPutEnabled property to true in the HTTP service settings and apply the security constraints outlined above.

4. J2EE 6.30

The HTTP PUT implementation has a different approach; refer to the official SAP documentation for detailed instructions.

Reason and prerequisites

The HTTP PUT method handler in the SAP J2EE Engine Release 6.20 is unprotected by default. This allows file upload operations without requiring user authentication or authorization. Potential risks include filling up the server's file system or uploading and executing malicious programs, rendering the server unavailable.

References

• SAP Note 606733 – SAP J2EE – Composite SAP Note on Security of Basis 6.20
• SAP Note 602194 – SAP FSCM – Biller Direct: Stopping PUT Requests