SAP Security Note
Medium priority
SAP security note 1267536, "Protecting directory traversal", is a note released on 08.10.2009. Below are the symptom and SAP recommended solution.
Description
Symptom
An attacker can traverse the server directory using “..” in the file name parameter of a URL.
Solution
This issue has been corrected in BPC 5.1 SP4. The server module now checks if the file name parameter contains “..”. If it does, the module does not read the file and returns the error message, “The path cannot be found.”
Reason and prerequisites
The server module responsible for returning a file’s content did not validate whether the file name parameter contained “..”.
Full note on SAP: SAP Support Launchpad note 1267536
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
