Directory Traversal vulnerability in Profile Maintenance, SAP security note 2342473

SAP security note 2342473, "Directory Traversal Vulnerability in Profile Maintenance". Below are the symptom, SAP recommended solution, reason and prerequisites, CVSS score, references and affected software components.

Description

Symptom

The Profile Maintenance Function Modules allow an attacker to exploit insufficient validation of path information provided by users, thus characters representing ‘traverse to parent directory’ are passed through to the file access APIs.

Some well-known impacts of Directory Traversal vulnerability are:

• Attacker could read content of arbitrary files on the remote server and expose sensitive data
• Attacker could overwrite, delete, or corrupt arbitrary files on the remote server

Solution

The function modules now check that only files are accessed which are located in the directory specified with the profile parameter DIR_PROFILE. Install the latest Support Package containing the fix or implement the attached correction instruction.

• Note 1 for NetWeaver 7.00, 7.01, 7.10, and 711: there is no separate correction instruction due to complex dependencies. So the mentioned Support Package shall be applied.
• Note 2 for NetWeaver 7.00, 7.01, 7.10, and 7.11: if you use Kernel 7.20 with patch level smaller than 43 (instead of the DCK), you have to install a kernel with a newer version. Otherwise, the correction will have no effect.

Reason and prerequisites

The profile maintenance function modules did not properly check the passed filename argument.

CVSS

Score 0

References

Affected components

• SAP_BASIS 700 to 752
• SAP_BASIS 710 to 751