Skip to main content
SAP Pentest Playbook
Toggle Dark/Light/Auto mode Toggle Dark/Light/Auto mode Toggle Dark/Light/Auto mode Back to homepage
  2. /
  3. Other SAP Solutions
  4. /
  5. SAP Web Dispatcher
  6. /
  7. Web Dispatcher URL Filter / Routing Rule Misconfiguration (Internal Path Exposure)
Edit page

Web Dispatcher URL Filter / Routing Rule Misconfiguration (Internal Path Exposure)

Description

SAP Web Dispatcher’s URL filter - configured via the wdisp/permission_table profile parameter pointing at a ptabfile - is the only control deciding which backend ICF paths an external client on the untrusted side of the DMZ is allowed to reach through the Web Dispatcher at all.

The file’s syntax mirrors SAProuter’s route-permission table: lines of [P|D|S] <URI pattern> (permit / deny / secure-only), evaluated top-down, first-match-wins, with a leading or trailing * wildcard permitted in the URI pattern. If the file is missing, empty, or - critically - does not end with an explicit D * deny-all as its last rule, any backend ICF service that the Web Dispatcher can reach becomes reachable from the external network, regardless of what narrower P/D rules appear earlier: a broad early P rule silently shadows any deny intended below it, because evaluation stops at the first match.

SAP’s own hardening guidance calls out a specific set of internal-only paths that must be explicitly denied even on an otherwise-permissive filter, because they leak infrastructure/configuration detail: /sap/public/icman/*, /sap/public/ping, /sap/public/icf_info/*, and /sap/wdisp/info (the Web Dispatcher’s own internal status/config page).

A historical worked example of what an absent or bypassed URL filter enables is the NetWeaver Java Portal “Kiss of Death”: on EP 7.0 (fixed from 7.01 onward), GET /ctc/servlet/com.sap.ctc.util.ConfigServlet?param=com.sap.ctc.util.FileSystemConfig;EXECUTE_CMD;CMDLINE=<command> executes an arbitrary OS command as <sid>adm with no authentication or authorization check - SAP shipped no direct fix because the service is used internally by SAP tooling itself and cannot simply be disabled, leaving URL filtering at the Web Dispatcher (or an equivalent front-end firewall/WAF) as the only available mitigation. Any Web Dispatcher deployed in front of such a backend without an allow-list that excludes /ctc/servlet/*-class CTC paths passes the attack straight through.

Note
The “Kiss of Death” example is legacy (EP 7.0-era NetWeaver Java) - cited here because SAP’s own security literature uses it as the canonical illustration of what a missing/misordered Web Dispatcher URL filter exposes, not as a currently-exploitable path on modern releases.

Risk

Because the Web Dispatcher is deliberately the single externally-reachable entry point in front of an otherwise network-segmented SAP landscape, a URL filter gap is not one exposed service among many defenses - it is the remaining control. A missing, empty, or misordered ptabfile (or one that was never deployed at all, since wdisp/permission_table is optional) exposes whatever ICF service tree the Web Dispatcher can reach, including configuration-disclosure endpoints (/sap/wdisp/info) and, on unpatched/legacy backends, unauthenticated OS-command-execution services that a correctly filtered Web Dispatcher would have blocked at the edge.

Options

  • Discovery - request known internal-only/status paths directly against the Web Dispatcher’s exposed HTTP(S) port(s): /sap/wdisp/info, /sap/public/icman/*, /sap/public/icf_info/*, and a standard SAP ICF service-path wordlist (/sap/bc/*, /sap/crm/*, /sap/public/*); a response that isn’t the filter’s own deny page indicates the path is being proxied through.
  • Config disclosure via /sap/wdisp/info - if reachable, discloses Web Dispatcher/backend configuration detail without needing the admin-interface credentials covered in Admin Interface Exposure - a lower-bar companion information leak when the URL filter itself is the only control present and is misordered or absent.
  • Historical worked example - NetWeaver Java Portal Kiss of Death: /ctc/servlet/com.sap.ctc.util.ConfigServlet?param=com.sap.ctc.util.FileSystemConfig;EXECUTE_CMD;CMDLINE=<cmd> on unpatched EP 7.0 backends reachable through an unfiltered Web Dispatcher - arbitrary OS command execution as <sid>adm, no authentication.
  • Manual equivalent: direct curl/browser requests against the Web Dispatcher’s HTTP(S) port(s) walking a known SAP ICF service-path wordlist looking for anything not returned as filter-denied.
  • Precondition: wdisp/permission_table unset/empty, missing its terminal D * deny-all rule, or ordered so a broad earlier P rule shadows an intended later deny (first-match-wins evaluation) - or the front-end/WD-exposed backend has ICF service nodes activated wholesale (/default_host/sap/bc/*) rather than the specific minimal set required.

Mitigation

  • Configure wdisp/permission_table as a positive allow-list, always terminated by an explicit D * deny-all as the last-evaluated rule.
  • Explicitly deny the known information-disclosure/internal paths regardless of other allow rules: D /sap/public/icman/*, D /sap/public/ping, D /sap/public/icf_info/*, D /sap/wdisp/info.
  • Never activate ICF service trees wholesale (/default_host/sap/bc/*) on a front-end server exposed through the Web Dispatcher; activate only the specific services actually required (e.g. the documented minimal Fiori launchpad service set) and mirror that same minimal set in the Web Dispatcher’s allow-list.
  • On NetWeaver Java front-ends, ensure /ctc/servlet/* and other CTC-class administrative endpoints are never reachable through the Web Dispatcher, since SAP cannot disable the underlying service.
  • Bound wdisp/max_permitted_uri_len, wdisp/max_permission_table_size, and wdisp/max_permission_table_entry_size at sane values as secondary hardening.
  • Prefer S (secure/HTTPS-only) over P for any path that must remain externally reachable.

Detection and Monitoring

  • Web Dispatcher/ICM access log: successful (2xx/3xx) responses for paths outside the documented allow-list, especially /sap/wdisp/info, /ctc/servlet/*, or any /sap/bc/* path not in the approved Fiori/OData/portal service set.
  • Alert immediately on any external request reaching a ConfigServlet/CTC-class path with EXECUTE_CMD/CMDLINE parameters - an unambiguous exploitation attempt regardless of response.
  • Periodic external black-box scan of the Web Dispatcher’s exposed port(s) against the standard SAP ICF path wordlist to catch filter drift from the intended allow-list over time.

References

  • SAP-Systeme schützen (Rheinwerk/SAP PRESS), ch. 6.5 “Angriff auf den SAP Web Dispatcher” - Kiss of Death worked example and URL-filter mitigation
  • SAP Security and Risk Management (Rheinwerk/SAP PRESS), ch. 14.1 - wdisp\permission_table (ptabfile) syntax, D /sap/public/icman/* / D /sap/wdisp/info hardening list
  • Implementing SAP Fiori® 3 Security (SAP PRESS) - Web Dispatcher Fiori-service minimal allow-list guidance
  • Admin Interface Exposure - companion config-disclosure vector