Potential directory traversals in applications, SAP security note 1497003

SAP security note 1497003, "Potential directory traversals in applications". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

Systems may exhibit runtime errors or security audit log entries indicating unauthorized file access attempts via directory traversal.

Solution

The note introduces enhancements to the ABAP runtime (KERNEL and SAP_BASIS) to normalize file paths and enforce validation against defined logical file names. Key measures include:

• Path normalization: removes redundant path components (e.g., a/./b becomes a/b), eliminates path components followed by .. (e.g., a/b/../c becomes a/c), and standardizes path separators based on the operating system.
• Case insensitivity: on Windows platforms, path comparisons are case-insensitive to align with the OS behavior.
• Authorization enhancements: implements flags FS_NOREAD and FS_NOWRITE and checks against authorization object S_PATH, restricting file system access based on configured paths and aliases.
• Logical file name validation: administrators can define aliases and valid directories for logical file names, and a mechanism ensures physical file names are validated against these definitions.
• Reporting and auditing: enhancements to report RSFILENA help identify unconfigured logical file names; security audit logs can be configured to monitor validation activities and detect unauthorized access attempts.

Implementation steps:

• Kernel update: update your kernel to the patch level specified in the Support Package section of this note (e.g., for Release 46C, apply SAPKB46C61).
• Import transport requests: download the relevant transport files from the SNOTE download and import these transport requests into your system.
• Execute reports: run report RSFILECR using transaction SA38 to configure logical file names and paths.
• Configure logical file names: define aliases and validation paths using transaction FILE, ensuring all logical paths are properly configured to match your application’s directory structure.
• Activate path validation: activate file name validation features and monitor the security audit log for any issues; adjust scheduled jobs to account for the new validation mechanisms to prevent disruptions.

Configuration:

• Authorization object S_DATASET: ensure proper configuration to restrict file system access based on normalized paths.
• Customization table SPTH: normalize all path entries and configure FS_NOREAD and FS_NOWRITE flags as needed.
• Logical file names: define and alias logical file names to enforce validation and restrict access to authorized directories.

Reason and prerequisites

Some SAP applications allow the input of physical or logical file names without proper validation, introducing security risks.

Affected components

• SAP_APPL (31I, 40B, 45B)
• SAP_BASIS (46C, 46B, 620, 640, 700, 701, 702, 730)