Directory traversal in BW, SAP security note 1575722

SAP Note 1575722
SAP Security Note
High priority

SAP security note 1575722, "Directory traversal in BW", is a program error note released on 09.08.2011. Below are the symptom and SAP recommended solution.

ComponentSAP Business Warehouse > Business Explorer > OLAP Technology > Interface to Database

CategoryProgram error

PriorityCorrection with high priority

TypeSAP Security Note

Version3

StatusReleased for Customer

Released on09.08.2011

LanguageEnglish (Master Language: German)

Description

Symptom

BW contains a vulnerability through which a malicious user can potentially write arbitrary files on the remote server, possibly corrupting data or altering system behavior.

Solution

Import the relevant Support Package for your BW system version:

SAP NetWeaver BW 7.00: import Support Package 28 (SAPKW70028).
SAP NetWeaver BW 7.01: import Support Package 11 (SAPKW70111).
SAP NetWeaver BW 7.02: import Support Package 10 (SAPKW70210).
SAP NetWeaver BW 7.11: import Support Package 8 (SAPKW71108).
SAP NetWeaver BW 7.30: import Support Package 05 (SAPKW73005).

After importing the Support Package, perform the following manual configurations using transaction /NFILE:

Logical File Path Definition: add new entries for BW_RSDR with the name "BW DataManager".
Assignment of Physical Paths to Logical Path: UNIX /tmp/<FILENAME>; Windows NT <P=DIR_TEMP>\<FILENAME>.
Logical File Name Definition, Cross-Client: add a new entry for BW_RSDR with name "BW DataManager", physical file empty, data format DIR, application area BW, logical path BW_RSDR.

Before implementing the corrections, ensure that you specify the return type in transaction /NLISTCUBE. For example, if "Store in file (appl. server)" is selected, you can specify any directory. After applying the corrections, only the specified directories (/tmp/<FILENAME> for UNIX and <P=DIR_TEMP>\<FILENAME> for Windows NT) can be used.

Reason and prerequisites

BW fails to correctly validate the path to which a user-submitted file is written. As a result, a malicious user can potentially overwrite data in the remote system.

References

Full note on SAP: SAP Support Launchpad note 1575722

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Directory traversal #BW_RSDR #LISTCUBE #FILE_VALIDATE_NAME