Potential directory traversal in the FRP administration, SAP security note 1621807

SAP security note 1621807, "Potential directory traversal in the FRP administration", is a note released on 13.12.2011. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

This SAP Security Note addresses a potential directory traversal vulnerability in the FRP (Forecasting and Replenishment) administration of the Supply Chain Management (SCM) system. A malicious user could exploit this vulnerability to write arbitrary files on the remote server, potentially corrupting data or altering system behavior.

Solution

The issue is mitigated by ensuring that only authorized directories are accessible during file operations in transaction /FRE/FRP_ADMIN. The correction ensures that before writing a file, the file path undergoes a validation process to prevent access to directories outside the intended path.

Reason and prerequisites

The vulnerability arises because the program specified in the correction instructions does not properly validate the file path. Although the file path is determined using the system variable <DIR_GLOBAL> and cannot be changed in transaction /FRE/FRP_ADMIN, insufficient validation allows access to unauthorized directories.

Affected components

• SCM 500
• SCM 510
• SCM 700
• SCM 701
• SCM 702
• SCM 712