ITS security issue when download, execute program warning

[Former Member]

Hi Emre,

Thanks a lot for taking your time to reply.

Although i dont know how to set JAVABEAN attribute, but i have done lot of debugging to the function call cl_gui_frontend_service=>execute from the SAP WebGui, and i could not find this attribute being checked. In my case following code is the real code executed:

CALL METHOD OF doc-obj 'ExecuteEx'

       EXPORTING #1 = mcommandline

                 #2 = mprogram

                 #3 = mOperation.

in Include LSIT1O01 line 480. This starts an applet for execution of a commandline. Java console says all ok, but then this popup comes:

BR

SSA

[cris_hansen · Accepted solution]

Hello Salman,

Please read SAP note 1555523. You will need to adjust the white list in webgui.cfg for the proper external executable execution. I hope this helps.

Regards,

Cris

[Former Member · Accepted solution]

Thanks Cristiano, issue resolved.

With the help of note 1555523, i was able to put right enteries in WEBGUI.cfg.

The contents of webgui.cfg are:

FILE_EXECUTE_EXECUTABLE_ALLOWED=C:\Windows\System32\cscript.exe;

FILE_EXECUTE_EXTENSIONS_ALLOWED=exe;vbs

note that in white list, i had to provide complete path of the application executable.

Regards

Salman

[Former Member]

Hi Salman,

I've got a similar problem.

If you allow the "exe" extension, than EVERY exe is allowed to be executed, not just the one you specified with FILE_EXECUTE_EXECUTABLE_ALLOWED. At least in our scenario.

Is there a solution, where you can allow just specific exe files?

regards

Martin

[Former Member]

Hi Martin,

have you tired commenting / removing "FILE_EXECUTE_EXTENSIONS_ALLOWED=exe;vbs" from the webgui.cfg? the file should only contain "FILE_EXECUTE_EXECUTABLE_ALLOWED=<your exe>".

although for me, only that executable was working which i mentioned as in my previous post. may be a different jvm version i guess!!!

[Former Member]

Hi Salman,

thanks for the quick response.

My Config looks like this:

# FILE_EXECUTE_EXTENSIONS_ALLOWED=exe

FILE_EXECUTE_EXECUTABLE_ALLOWED=C:\Windows\notepad.exe

That only works, if I uncomment the first statement. Otherwise I get an error, that execution of exe-files are permitted.

JVR is 8 Update 60 with Security Level High not Very High

SAP-Kernel 742

Patch 300

Why do you allow a specific exe file, if you already allowed the execution in general?

regards

Martin

[Former Member]

Hi,

I've got the solution.

The problem wasn't at Java (unbelievable I know). It was a mistake at the abap site.

wrong:

CL_GUI_FRONTEND_SERVICES=>EXECUTE

     document = 'some_executable.exe'    

right:

CL_GUI_FRONTEND_SERVICES=>EXECUTE

     application = 'some_executable.exe'  

Then everything works just fine.

regards

Martin

[Emre_tr]

I've got same error. I am not sure we can able to execute fronted application through webgui screens.

Normal download functionality is working in ALV list with webgui screen.