Directory Traversal in IS-R-LG-RMA, SAP security note 1535062

SAP security note 1535062, "Directory Traversal in IS-R-LG-RMA", is released on 08.02.2011. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

There is a potential directory traversal vulnerability in the component IS-R-LG-RMA. Specifically, the report RWRF_ORGPRICE_SETUP allows malicious users to read arbitrary files on the remote server, which can lead to the disclosure of confidential information.

Solution

To address this issue, refer to Note 1497003 for additional information. The corrections provided in Note 1497003 are required before implementing this note.

Steps to Implement:

• Logical File Names: Created logical file names ISR_RMA_ORGPRICE_LOG_FILE and ISR_RMA_ORGPRICE_PHY_FILE. These allow validation of logical and physical file names.
• Recommended Directory Structure: Organize directories to reflect user and program structures. Define physical path names using already defined parameters in transaction FILE (F1 help for physical path).
• Configuration: Maintain the physical path for the syntax group UNIX for the logical path ISR_RMA_PATH using transaction FILE: /usr/SAP/data/<SYSID>/<CLIENT>/. Define logical file names with appropriate data formats and references.
• Validation: Ensure that file paths are validated based on the logical file names to prevent unauthorized access.

Reason and prerequisites

The vulnerability arises because the report RWRF_ORGPRICE_SETUP does not properly validate the file path when referencing files on the remote server. This flaw enables attackers to manipulate the program to access unintended files within the system.

References

• 1497003 – Potential directory traversals in applications

Affected components

• EA-RETAIL 603
• EA-RETAIL 604
• EA-RETAIL 605