SAP security note 1692988, "Directory traversal in SFTP modules", is a security note. Below are the symptom and SAP recommended solution.
Description
Symptom
BC-SRV-COM-FTP contains a vulnerability through which a malicious user can potentially write arbitrary files on the remote server, possibly corrupting data or altering system behavior.
Solution
Please implement the correction instructions attached to this SAP Note (manual and automatic).
To perform a directory traversal check, the logical path name against which the physical path should be validated must be provided by the applications using SAPFTP.
Refer to the following notes for additional configurations:
- Note 1686247 to enable the security audit logs.
- Note 1497003 for the logical path configuration.
To allow applications to set the logical path, the following class/function module has been created:
For releases >= 620: a singleton class named FTP_LOGICAL_PATH_CHECK has been created. Applications must use the method FTP_SET_LOGICAL_PATH to set the logical path name.
For releases < 620: applications must use the function module FTP_SET_LOGICAL_PATH to set the logical path name.
Once you have implemented this note, please implement Note 1754531 for the functionality to work.
Reason and prerequisites
BC-SRV-COM-FTP fails to correctly validate the path a user-submitted file is written to. Through this, an attacker can potentially overwrite data on the remote system.
Please implement Note 1605054 before implementing this note.
CVSS
Score 7.1 Vector: AV:N/AC:H/AU:S/C:C/I:C/A:C
References
This note refers to
- Note 1808106 – Update #2 to Security Note 1692988
- Note 1775527 – Update 1 to Security Note 1692988
- Note 1754531 – Issue with SFTP authority check with note 1692988
- Note 1725378 – Path evaluation for SAPFTP functionality in CA-DMS
- Note 1710330 – Path evaluation for SAPFTP functionality in BC-SRV-KPR
- Note 1686247 – SAL | Interfaces for additional audit log messages (02)
- Note 1605054 – Restriction in access to FTP Servers & usage of test reports
- Note 1497003 – Potential directory traversals in applications
- Note 93042 – Problems with SAPFTP
Full note on SAP: SAP Support Launchpad note 1692988
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].