Skip to main content
SAP Pentest Playbook
Toggle Dark/Light/Auto mode Toggle Dark/Light/Auto mode Toggle Dark/Light/Auto mode Back to homepage
  2. /
  3. Other SAP Solutions
  4. /
  5. SAP Web Dispatcher
  6. /
  7. Web Dispatcher Admin Interface Exposure (/sap/wdisp/admin Weak Credentials & Config Disclosure)
Edit page

Web Dispatcher Admin Interface Exposure (/sap/wdisp/admin Weak Credentials & Config Disclosure)

Description

SAP Web Dispatcher’s web-based administration/monitoring interface is bound to /sap/wdisp/admin (activated via the icm/HTTP/admin_<xx> profile parameter) and gated by HTTP Basic authentication against a realm SAP labels “WEB ADMIN”. Per SAP’s own installation guidance, the admin account created at install time is named webadm, initially authenticated with the installation master password - a name and provisioning pattern operators frequently leave on a weak or easily-guessed password (webadm, Welcome1, admin) rather than rotating post-install, alongside sibling naming conventions (wdadmin, sapadmin) seen across real deployments.

Once Basic auth is satisfied, the admin interface discloses the Web Dispatcher’s routing configuration in full: every wdisp/system_N parameter line (SID, MSHOST, MSPORT, SSL_ENCRYPT, SRCURL, SRCVHOST per backend), the kernel patch level/build date, and wdisp/permission_table contents - collectively the internal backend topology the Web Dispatcher exists to hide from the untrusted network it faces. The interface’s exact URL shape (.icp SAPUI5 pages, MonitorAction.html?action=..., info?type=parameter, or a REST api/v1/parameters path) varies by kernel version, and one candidate - /sap/wdisp/admin/public/default.html - is served anonymously as the static SPA landing page on most kernels (always 200, with or without credentials), which is a false-positive trap for naive credential-verification logic: a genuine auth gate must be located first (walking candidates until one returns 401 unauthenticated) before testing credentials against it.

The Web Dispatcher’s own Basic-auth credential store, icmauth.txt (<DRIVE>:\usr\sap\<SID>\SYS\global\security\data\icmauth.txt / the equivalent UNIX path), holds user:{ALGO}<base64-digest>:<comment> records ({SHA}/{SHA256}/{SHA384}/{SHA512} depending on kernel generation) rather than plaintext - a hardening measure by SAP design - but the digests are directly hashcat-crackable (modes 100/1400/10800/1700 respectively) if the file can be read.

Risk

An attacker who reaches the Web Dispatcher’s HTTP(S) port and either finds icm/HTTP/admin reachable without network-layer HOST/CLIENTHOST restriction, or guesses/brute-forces a weak admin credential, obtains a complete map of the backend SAP landscape (every SID, message-server host, port, TLS posture) sitting behind the Web Dispatcher - intelligence that directly targets subsequent attacks at the correct backend instead of blind probing. If the admin interface additionally permits configuration changes (not just read), routing rules and TLS trust settings become directly attacker-modifiable. Successful extraction of icmauth.txt converts into offline password cracking against every configured admin/monitor account.

Options

  • Credential probing - SAPMAP modules/exploitation/sap_wdisp_admin.py, probe_wd_admin_credentials(): walks a top-12 default/weak credential list (webadm/webadm, webadm/Welcome1, webadm/admin, wdadmin/wdadmin, wdadmin/Welcome1, sapadmin/sapadmin, sapadmin/Welcome1, admin/admin, admin/Welcome1, admin/manage, administrator/administrator, Administrator/Administrator) against a pre-flight-verified genuine 401 auth gate - auto-flips HTTP↔HTTPS on connect failure or on HTTPS-only Basic-auth profiles. Operator-supplied wordlists override the built-in list for a real credential-spray engagement.
  • Authenticated config extraction - fetch_wd_systems() in the same module: once credentials work, walks navData.icp (the SAPUI5 SPA’s authoritative navigation map for the specific kernel build) plus ~30 canonical parameter-readout endpoint shapes across kernel generations (7.4x–7.9x), falling back to scraping the admin index’s JS for XHR URL hints when none of the canonical endpoints hit - parses every wdisp/system_N = SID=..., MSHOST=..., MSPORT=..., SSL_ENCRYPT=..., SRCURL=... line from either plain-text or HTML-table kernel output.
  • icmauth.txt extraction (best-effort) - download_icmauth() walks a list of undocumented file-viewer endpoints under /sap/wdisp/admin/icp/; parse_icmauth() converts any recovered {ALGO}<base64> digest lines into hashcat-ready user:hexhash records with the correct -m mode.
  • Manual equivalent: browse to https://<host>:<port>/sap/wdisp/admin/public/default.html, authenticate as webadm with the install master password or a guessed default (SAP Note 908097 confirms webadm as the provisioned account name); wdispmon provides the same data but only locally via shared memory, not remotely.
  • Precondition: network reachability to the Web Dispatcher’s configured HTTP(S) port; icm/HTTP/admin_<xx> active without a restrictive HOST/CLIENTHOST scope, and/or a weak/default icmauth.txt credential.

Mitigation

  • Change the webadm account’s password away from the installation master password immediately post-install (SAP Note 908097); audit for any of the top-12 weak credential pairs above on every configured admin account.
  • Scope icm/HTTP/admin_<xx> with its HOST/CLIENTHOST options so the admin interface is reachable only from the intranet/administrative network segment; disable it entirely (icm/HTTP/admin_<xx> unset) if unused.
  • Serve the admin interface over SSL/TLS only - the credential (and hash) is transmitted at logon and must not cross the wire in cleartext.
  • Use a strong (16+ character), unique admin password and, where the kernel build supports it, require a client certificate in addition to Basic auth.
  • Protect icmauth.txt at the OS filesystem level; restrict read access to <sid>adm only.
  • Block /sap/wdisp/info and other internal info endpoints via the URL permission table (D /sap/wdisp/info) as defense-in-depth even when the admin interface itself is properly scoped - see Routing Rule Abuse.
  • Keep the Web Dispatcher at the SAP Note 908097-recommended current patch level.

Detection and Monitoring

  • Web Dispatcher/ICM access log: repeated 401 responses against /sap/wdisp/admin* paths from a single source in rapid succession - a textbook credential-spray signature; distinguish from the benign SPA’s own repeated anonymous hits to /sap/wdisp/admin/public/default.html.
  • Any successful admin logon (200/non-401 response on a path that previously 401’d) from a source IP outside the documented admin/management network.
  • File-access auditing on icmauth.txt outside the standard wdispmon/install workflow.
  • Anomalous request volume against .icp, MonitorAction.html?action=..., or info?type=parameter-shaped URLs beyond normal monitoring traffic - consistent with the broad endpoint-guessing pattern this technique uses across kernel versions.

References

  • SAP Note 908097 - SAP Web Dispatcher: Release, Installation, Patches, Documentation (confirms webadm default admin account, /sap/wdisp/admin URL, install-master-password initial credential)
  • SAP® System Security (SAP PRESS, 2026) - Web Dispatcher admin console URL, webadm account, password-reset guidance
  • SAP Security and Risk Management (Rheinwerk/SAP PRESS), ch. 14.1 - icm/HTTP/admin HOST/CLIENTHOST hardening, SSL-for-admin-access guidance
  • SAP® System Security Guide (SAP PRESS) - icmauth.txt generation via wdispmon/icmon -a, hash-not-plaintext storage design