SAP security note 1677291, "Potential denial of service in Web Application Components", addresses the following vulnerability. Below are the symptom, reason, SAP recommended solution, references and the affected software components.
Description
Symptom
An attacker can remotely exploit SAP Web Application Servers – through IC Manager, Web Dispatcher, or Message Server – rendering the servers and potentially the resources they use unavailable, resulting in a Denial of Service (DoS).
Solution
A kernel patch is provided that introduces the profile parameter ict/max_form_fields, which limits the maximum number of form fields per HTTP request processed by the HTTP parser. This mitigates the vulnerability caused by hash table collision attacks. The default value of the parameter is 5000 and can be changed either dynamically via transaction RZ11 or by editing the application server instance’s start profile.
Reason and prerequisites
The issue is caused by a resource exhaustion condition. An attacker can send a specifically crafted request that causes the process to consume excessive resources. As a result, no other processes can allocate new resources, making the system unavailable. This condition can be intentionally triggered by an attacker to cause a denial of service.
References
- Automatic checks for security notes using RSECNOTE (outdated)
- ERROR ==> Number of form fields exceeds limit of 5000 (ictxxHttp2)
- Parameter ict/max_form_fields cannot be changed dynamically
- AVA@SAP: Probleme mit unvollständig gespeicherten Daten
Affected components
- Basis Components > Client/Server Technology > Message Service (BC-CST-MS)
- Basis Components > Client/Server Technology > Internet Communication Manager (BC-CST-IC)
- Basis Components > Client/Server Technology > Web Dispatcher (BC-CST-WDP)
Full note on SAP: SAP Support Launchpad note 1677291
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
