SAP security note 1622551, "Verb Tampering issues in LMCFG". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
Problems with authorization and authentication checks in conjunction with the use of unusual HTTP methods exist in CTC.
Solution
Apply the official patch from the SAP Service Marketplace to automatically update the web.xml file with the required changes.
If no patch is available for your specific release, consider the following options.
Manual Implementation
- Locate the <security-constraint> section in the web.xml files of the affected SDAs and remove all <http-method> elements within this section.
- Redeploy the modified SDAs on the application server.
- Ensure the AS Java server is restarted to apply changes.
Workaround: Disable Application Aliases. Access SAP NetWeaver Administrator at https://<host>:<port>/nwa, navigate to Configuration > Connectivity/Infrastructure > Java HTTP Provider Configuration > Virtual Hosts > Application Aliases, and remove the "Active" flag from the aliases ctc/additional (for 7.1x, 7.2x, and 7.3x) and ctc/a1s (for 7.1x and 7.2x only). Do not use this workaround if CTC functionality is actively used, as it will disrupt internal access.
Workaround: Prevent Remote Connections to CTC through URL Blocking. Filter the following URL patterns via firewall or IDS to prevent remote access:
- For SAP NetWeaver 7.1x and 7.2x: http(s)://[SERVER]:[PORT]/ctc/a1s/*, http(s)://[SERVER]:[PORT]/ctc/a1s/servlet/*, http(s)://[SERVER]:[PORT]/ctc/additional/*, http(s)://[SERVER]:[PORT]/ctc/additional/servlet/*, http(s)://[SERVER]:[PORT]/ctc/additional/ConfigServlet
- For SAP NetWeaver 7.3x: http(s)://[SERVER]:[PORT]/ctc/additional/*, http(s)://[SERVER]:[PORT]/ctc/additional/servlet/*, http(s)://[SERVER]:[PORT]/ctc/additional/ConfigServlet
These workarounds block access but do not eliminate the underlying vulnerability.
Reason and prerequisites
CTC contains Verb Tampering vulnerabilities, posing a risk of information disclosure if accessed with unexpected HTTP methods. Verb Tampering attacks can be executed from arbitrary network locations and can lead to indirect attacks on target systems.
Prerequisites: the SAP_ungranted_role should never be granted to any user. Ensure SAP Note 1445998 is applied to disable invokerservlet (not required for NW 7.20 SP03 and above). While Verb-Tampering and InvokerServlet problems and solutions are not prerequisites of each other, it is recommended to apply both fixes.
References
Affected components
- LM CONFIGURATION (7.10 to 7.31)
- LMCFG-BYD (7.20)
Full note on SAP: SAP Support Launchpad note 1622551
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
