Potential Directory Traversal in PY-NL, SAP security note 1598699

SAP security note 1598699, "Potential Directory Traversal in PY-NL", released on 16.11.2011. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

This Security Note addresses vulnerabilities in the PY-NL component that allow malicious users to perform directory traversal attacks. These vulnerabilities could enable unauthorized reading of arbitrary files on the remote server, potentially disclosing confidential information, or writing arbitrary files, which could corrupt data or alter system behavior.

Solution

Implement the relevant Support Package for your release or apply this note via SNOTE. Manual customization steps are required as outlined in the correction instructions. Specifically, the validation of physical file names is extended for the following logical files:

• HR_NL_EDM_IN
• HR_NL_EDM_DONE

Prerequisite: Apply SAP Note 1497003 before implementing this Security Note.

Reason and prerequisites

1. Read arbitrary files: Programs in the correction instructions have vulnerabilities that allow malicious users to read arbitrary files on the server.

2. Write arbitrary files: Some programs can be exploited to write arbitrary files, leading to data corruption or altered system behavior.

CVSS

Score 0

References

• Update #1 to Security Note 1598699 (Note 1653738)
• Potential Directory Traversals in Applications (Note 1497003)

Affected components

• SAP_HR 46C
• SAP_HRCNL: 470, 500, 600, 604