SAP security note 1584242, "Directory Traversal in the RSCRM framework", is a note. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
The RSCRM framework fails to correctly validate the path where a user-submitted file is written. This oversight allows an attacker to potentially overwrite data on the remote system by manipulating file paths.
Solution
To mitigate this vulnerability, apply the appropriate support package for your SAP NetWeaver BW version:
- SAP NetWeaver BW 7.00: Support Package 27 (SAPKW70027)
- SAP NetWeaver BW 7.01: Support Package 10 (SAPKW70110)
- SAP NetWeaver BW 7.02: Support Package 09 (SAPKW70209)
- SAP NetWeaver BW 7.11: Support Package 08 (SAPKW71108)
- SAP NetWeaver BW 7.30: Support Package 04 (SAPKW73004)
The RSCRM framework now uses the function FILE_VALIDATE_NAME to enhance security. Assign a physical path to the logical path RSCRM_FILE_EXTRACT_PATH in transaction FILE. This ensures that filenames are validated to be within the specified logical path and do not contain unauthorized path segments like "..".
References
Affected components
- SAP Business Warehouse > Enhanced Infrastructure > Retraction (BW-EI-RTR)
- SAP NetWeaver BW 7.00
- SAP NetWeaver BW 7.01
- SAP NetWeaver BW 7.02
- SAP NetWeaver BW 7.11
- SAP NetWeaver BW 7.30
Full note on SAP: SAP Support Launchpad note 1584242
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].