Directory Traversal vulnerability in SAP BusinessObjects Platform, SAP security note 2288991

SAP security note 2288991, “Directory Traversal Vulnerability in SAP BusinessObjects Platform”. Below are the symptom and SAP recommended solution.

Description

Symptom

SAP BusinessObjects systems allow an attacker to exploit insufficient validation of path information provided by users, thus allowing modification of files provided as part of the SAP BusinessObjects installation.

Some well-known impacts of the Directory Traversal vulnerability include:

• Data Exposure: An attacker could read the content of arbitrary files on the remote server, exposing sensitive data.
• Data Manipulation: An attacker could overwrite, delete, or corrupt arbitrary files on the remote server.

Solution

This issue is fixed in the patches listed in the “Support Packages & Patches” section below. The fix enhances existing solutions to further protect files that are part of the SAP BusinessObjects suite. After applying the fix:

• Some Schedule and Send To operations may produce errors instead of delivering to the desired File System destinations.
• Non-whitelisted paths pointing to locations beneath the installation root for the SAP BusinessObjects suite will be rejected.

Recommendations for further protection:

• Restrict OS user permissions: configure the Server Intelligence Agent so that the process and its child processes run under an OS user with restricted rights. Ensure this user cannot write to folders or file shares where system harm could occur. Additionally, prevent non-administrators from having login rights on systems hosting SAP BusinessObjects deployments.
• Use whitelisting: employ the -whitelist argument on the command line of each Job Server as described in SAP Note 1759784. Note that this may not be feasible if all potential destination directory roots are not known at configuration time.

Reason and prerequisites

For exploitability, the File System destination type must be enabled on one or more Job Servers. By default, this destination type is not enabled.

CVSS

Score 4.3 Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

• SAP Note 1759784 – Fixed Security Risk for Unmanaged Disk Overwrite