Directory Traversal in Exportability Check Servlet, SAP security note 1628537

SAP Note 1628537

SAP security note 1628537, "Directory Traversal in Exportability Check Servlet". Below are the symptom and SAP recommended solution.

Description

Symptom

ESR support functionality allows running mass checks on objects, enabling users to specify the file name where results are stored. However, there is no validation on the file name input, allowing users to view any file on the server by using ../ in the file name.

Solution

This patch addresses the security issues in ESR that could lead to potential security threats, such as script injection attacks via URL parameters. The directory traversal vulnerability is fixed by ensuring that input fields in the Exportability Servlet do not allow navigation through the file system using .., /, and \ characters.

All affected versions are fixed. To determine the version in use, navigate to the Administration pages of ESR, click on the "Software Build Information" link, and check the Make Release and SPS Number.

Reason and prerequisites

User inputs for directory traversal are not validated. Specifically, inputs containing .., \, and / for navigation are not checked, allowing unauthorized access to the server’s file system.

CVSS

Score 6.8 Vector: AV:N/AC:L/AU:S/C:C/I:N/A:N

References

Full note on SAP: SAP Support Launchpad note 1628537

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Directory Traversal #ESR #Exportability Check #Script Injection