SAP security note 1718378, "Directory Traversal in Query Snapshot". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
BW contains a vulnerability through which a malicious user can potentially write arbitrary files on the remote server, possibly corrupting data or altering system behavior.
Solution
Ensure that SAP Note 1575722 is implemented in the system (including the manual pre-implementation steps).
BW fails to correctly validate the path to which a user-submitted file is written. As a result, an attacker can potentially overwrite data in the remote system.
- Before the implementation of the corrections: you were able to write performance traces using the SPA/GPA parameter RSR_QPROV_RSDRI_PERF if a query is based on QuerySnapShotIndex.
- After you implement the corrections: only the following directories can be selected – UNIX: /tmp/<FILENAME>; WINDOWS NT: <P=DIR_TEMP>\<FILENAME>.
If you try to write data under UNIX to /usr/sap/put/my_data, the system rejects this.
The settings are defined in transaction /NFILE. Logical File Path Definition: BW_RSDR. Logical File Name Definition, Cross-Client: BW_RSDR and implement the corrections.
Important: you must first read SAP Note 875986, which provides information about transaction SNOTE.
Reason and prerequisites
Query snapshot fails to correctly validate the path to which a user-submitted file is written. As a result, an attacker can potentially overwrite data in the remote system.
References
- 1575722 – Directory traversal in BW
- 1497003 – Potential directory traversals in applications
- 1479893 – BW LISTCUBE improvements
Affected components
- SAP_BW 7.30
- SAP_BW 7.31
Full note on SAP: SAP Support Launchpad note 1718378
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].