SAP security note 1678387, "Potential denial of service in AS Java Web container", is a program error note released on 09.10.2012. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
After an HTTP request, one of the following errors may be observed:
- There are too many parameters in the request. Maximum number of parameters in the request 1000 was exceeded. Check SAP note 1678387 for further information.
- Cannot parse the parameters of the request. Maximum number of parameters 5000 was exceeded.
Solution
Update to the latest version of AS Java (J2EE). If updating is not feasible, apply one of the patches listed in the Support Package Patch Level section of the note.
Adjust the MaxParameterCount property: depending on the application logic, after applying the patch, you might observe one of the error messages mentioned above. To mitigate this, increase the MaxParameterCount value:
- Recommended Maximum: 10,000 (values higher than this are not recommended)
- Default Values, versions 6.40, 7.00, 7.01, 7.02, 7.03: 1000
- Default Values, systems 7.10, 7.10 EHP1, 7.20, 7.30 and subsequent: 5000
Steps to change MaxParameterCount:
- Open the Config tool. For systems 7.10 – 7.3x, enable Expert mode from the View menu.
- Navigate to cluster-data -> Global server configuration or template -> service -> servlet_jsp.
- Click on MaxParameterCount.
- Enter the new value (e.g., 7000) in the Value field.
- Select Set Custom value and click the Save button in the top-right corner.
- Restart the cluster.
Reason and prerequisites
The issue is caused by a resource exhaustion condition. An attacker can send a specifically crafted request that consumes excessive resources, making the system unavailable.
References
- 1880668 – Mass data input issue when using planning application
- 1830931 – iViews Result set getting iViews Runtime Exception
Affected components
- ENGINEAPI
- SAP J2EE ENGINE CORE
Full note on SAP: SAP Support Launchpad note 1678387
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
