Verb Tampering issues in CTC, SAP security note 1589525

SAP security note 1589525, “Verb Tampering Issues in CTC”. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

This security note has been updated. For more detailed information, see Security Note 1624450.

Problems with authorization and authentication checks in conjunction with the use of unusual HTTP methods exist in CTC.

Solution

AS Java ships with numerous Web applications configured through their deployment descriptors (web.xml). To protect against this vulnerability, all HTTP method restrictions from the security-constraint section in the web.xml associated with the CTC Servlets must be removed.

• Apply Official Patch: download and apply the official patch for your respective release from the SAP Service Marketplace. If a patch is unavailable, consider the manual implementation or the workarounds below.
• Manual Implementation (if patch unavailable): locate and extract the relevant web.xml files from your SAP NetWeaver installation, remove all <http-method> elements within the <security-constraint> sections, then save and redeploy the modified web.xml files as per your NetWeaver version requirements. Detailed steps are available within the full SAP Note.
• Workaround, disable application aliases: access the Visual Administrator or SAP NetWeaver Administrator and disable the CTC-related application aliases to block access to vulnerable components. Do not use this workaround if CTC functionality is actively used.
• Workaround, prevent remote connections: configure your firewall or IDS to block specific URL patterns associated with CTC components, preventing remote exploit attempts.

Reason and prerequisites

The CTC/Configuration Wizard application (also known as the Template Installer) contains verb tampering vulnerabilities. This means there is a risk of information disclosure if the application is accessed with HTTP requests containing unexpected HTTP methods. Verb tampering issues can be exploited from arbitrary network locations.

Prerequisites:

• SAP_ungranted_role shall never be granted to any user.
• Ensure SAP Note 1445998 is applied to disable invokerservlet (not required for NW 7.20 SP03 and above).

CVSS

Score 7.5 Vector: AV:N/AC:L/AU:N/C:P/I:P/A:P

References

• Security Note 1624450
• Briefing at Black Hat conference on July 31st, 2013
• Briefing at Black Hat conference on August 4th, 2011

Affected components

• LM-TOOLS: 6.40 to 7.31
• LMCTC: 7.10 to 7.31