HTTP Response Splitting in SAP WAS

Risk: High
Local: No
Remote: Yes

CVSS Base Score: 5/10
Impact Subscore: 2.9/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: None
Integrity impact: Partial
Availability impact: None

(The following advisory is also available in PDF format for download at: ing_in_SAP_WAS.pdf ) CYBSEC S.A. Advisory Name: HTTP Response Splitting in SAP WAS (Web Application Server) Vulnerability Class: HTTP Response Splitting Release Date: 11/09/2005 Affected Applications: * SAP WAS 6.10 * SAP WAS 6.20 * SAP WAS 6.40 * SAP WAS 7.00 Affected Platforms: * Platform-Independent Local / Remote: Remote Severity: High Author: Leandro Meiners. Vendor Status: * Confirmed, patch released. Reference to Vulnerability Disclosure Policy: Product Overview: ================= SAP Web Application Server is an open standard-based platform for developing, and implementing Web applications. SAP Web Application Server is a crucial component of mySAP&#174; Technology platform as it serves as the underlying infrastructure for many SAP solutions (for example, SAP Portal). SAP WAS provides a development infrastructure on which to develop, distribute, and execute platform-independent Web services and business applications. SAP Web Application Server supports ABAP, Java, and Web services. The vulnerability discovered only applies to the BSP runtime of SAP WAS. Vulnerability Description: ========================== SAP Web Application Server was found to be vulnerable to HTTP Response Splitting, in the parameter sap-exiturl. For further reference regarding HTTP Response Splitting see the whitepaper "HTTP Response Splitting, Web Cache Poisoning Attacks, and Related Topics" (available at: e.pdf) Exploit (PoC): ============== If the string "%0a%0dHeader:+Value" is passed (omitting the double quotes) as the value for the parameter sap-exiturl the string "Header: value" (without the double quotes) is considered as another HTTP header, indicating the presence of the vulnerability. Solutions: ========== The solution, provided by SAP, is to disable support for the parameter in older 6.10 releases as well as SP's in 6.20 prior to SP54. For new 6.20 and 7.00 releases the sap-exiturl parameter will be submitted to a customer configured white-list. For further information see SAP Note 887322. Vendor Response: ================ * 09/23/2005: Initial Vendor Contact. * 09/27/2005: Technical details for the vulnerabilities sent to vendor. * 10/14/2005: Solutions provided by vendor for all vulnerabilities. * 11/09/2005: Coordinate release of advisory. Contact Information: ==================== For more information regarding the vulnerability feel free to contact the author at lmeiners<at> For more information regarding CYBSEC: ---------------------------- Leandro Meiners CYBSEC S.A. Security Systems E-mail: lmeiners (at) cybsec (dot) com [email concealed] Tel/Fax: [54-11] 4382-1600 Web: PGP-Key:

Vote for this issue:


Thanks for you vote!


Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024,


Back to Top