SAP security note 759387, “GRMG: Ensuring Password Security in GRMG Customizing”, is a note. Below are the symptom, reason and prerequisites, SAP recommended solution, references and the affected software components.
Description
Symptom
This note describes a security risk associated with GRMG scenario customizing files and provides a workaround to ensure complete security concerning sensitive password data in these files.
The CCMS GRMG (Generic Request and Message Generator) monitors the availability of web components, such as NetWeaver ABAP and J2EE engines, and SAP or non-SAP web services. GRMG scenarios, defined in XML documents, include properties that may contain passwords for accessing web services or other components. These customizing files are stored in a specific directory on the host where the web service runs.
Security Risk: If passwords are included in the GRMG customizing XML files, they are stored in unencrypted form in the GRMG upload directory. Although access to this directory is restricted, unauthorized access could expose these passwords.
Solution
To mitigate the security risk, customers should implement the following steps:
- Restrict access: limit access to hosts running GRMG-monitored components; secure the GRMG upload directory (/usr/sap/tmp/grmg on Linux/Unix, /usr/sap/prfclog/grmg on Windows, or as specified in the GRMGDIR parameter).
- Use central monitoring system: utilize a SAP NetWeaver ABAP Engine as the central monitoring system for GRMG. As of NW04 SP stack 04 (SAP_BASIS component Release 6.40 SP4), passwords in GRMG properties are encrypted in ABAP Secure Storage/DB.
- Avoid storing passwords in customizing files: when generating GRMG customizing files (via XCM, Visual Administrator, or directly creating XML), leave password properties empty to prevent storing unencrypted passwords.
- Set passwords post-upload: use transaction GRMG in the SAP ABAP engine to set passwords after uploading the customizing files.
- Encrypt password properties: when editing password properties in GRMG, set the property type to ‘PW’ to ensure encryption in ABAP Secure Storage/DB. Only set passwords in client 000, as the Monitoring Architecture dispatcher operates in this client and can access the stored passwords.
By following these recommendations, passwords will not be exposed at the file system level in GRMG customizing files.
Reason and prerequisites
There is a potential security risk related to storing passwords for web services in GRMG customizing files. This risk arises from the possibility of unauthorized access to these unencrypted passwords.
References
Affected components
- SAP_BASIS (620 to 640+)
- SAP_BASIS (700 to 700+)
Full note on SAP: SAP Support Launchpad note 759387
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
