SAP Security Note
High priority
SAP security note 1580718, "Directory Traversal in BC-SRV-ARL", was released on September 22, 2011. Below are the symptom and SAP recommended solution.
Description
Symptom
Archivelink contains a vulnerability that allows a malicious user to perform directory traversal, potentially writing arbitrary files on the remote server. This could lead to the disclosure of confidential information or data overwrites on the remote system.
Solution
Refer to SAP Note 1497003 for additional information and instructions. The corrections from this note are a prerequisite for implementing SAP Note 1580718.
Logical File Names Used in this Solution:
- ARCHIVLINK_FILE_READ
Reason and prerequisites
Archivelink does not correctly validate the path where a user-submitted file is written. An attacker can exploit this to overwrite data on the remote system.
References
Full note on SAP: SAP Support Launchpad note 1580718
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].