Reflected File Download vulnerability in AFPServlet, SAP security note 2169391

SAP security note 2169391, "Reflected File Download vulnerability in AFPServlet", is a program error note released on 28.07.2016. Below are the symptom and SAP recommended solution.

Description

Symptom

There is a possibility an end user can be tricked into downloading a non-existing executable file containing malicious code when certain query parameters are specified in the request URL to the AFP Navigation Servlet.

Solution

Refer to the Support Packages & Patches link to view the versions that include the fix.

Reason and prerequisites

AFP Navigation Servlet allows users to specify additional HTTP request parameters. The combination of ‘URI’ and ‘action’ parameters may lead to the download of a non-existing file by the end user. The file will be created when the server returns its HTTP response. This behavior of the AFP Navigation Servlet may be exploited as a Reflected File Download (RFD) Vulnerability, and an attacker can try to trigger an RFD attack.

CVSS

Score 7.5 / 10 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

References

• SAP Note 2120111 – Central Note for NetWeaver EP / EPC 7.30 SP14
• SAP Note 2116600 – Central Note for Portal Platform in SAP NW7.1 EhP1 SP15
• SAP Note 2110834 – Central Note for Portal Platform in SAP NW7.0 EhP1 SP18
• SAP Note 1743951 – Central Note for Portal Platform in SAP NW7.2 SP9