SAP security note 602194, “SAP FSCM – Biller Direct: Stopping PUT requests”, is a note. Below are the symptom, reason and prerequisites, SAP recommended solution and the related references.
Description
Symptom
SAP FSCM – Biller Direct: Stopping PUT requests.
Solution
For security reasons, SAP strongly recommends stopping access to the web server via PUT requests.
Note 604285 contains detailed information about how to stop PUT requests.
Reason and prerequisites
You use the application SAP FSCM – Biller Direct. The web application was installed on SAP J2EE Engine. Since it is possible to load data onto the web server using PUT requests, PUT requests should generally be stopped. You can do this by configuring the web.xml file (on the application level) or global-web.xml (on the global level).
On the application level of SAP FSCM – Biller Direct, PUT requests are not required.
References
Full note on SAP: SAP Support Launchpad note 602194
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
