Directory Traversal vulnerability in SAP NetWeaver AS Java Web Container, SAP security note 2486657

SAP security note 2486657, "Directory Traversal Vulnerability in SAP NetWeaver AS Java Web Container", is a note released on 10/10/2017. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

UPDATE 10th October 2017: This security note has been re-released after adding corrections for the following SPs:

• ENGINEAPI 7.50 SP02
• ENGINEAPI 7.50 SP03
• ENGINEAPI 7.50 SP04
• ENGINEAPI 7.50 SP05

AS Java Web Container allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing ‘traverse to parent directory’ are passed through to the file APIs.

Some well-known impacts of Directory Traversal vulnerability are:

• Attacker could read content of arbitrary files on the remote server and expose sensitive data
• Attacker could overwrite, delete, or corrupt arbitrary files on the remote server

Solution

Update AS Java to the latest version. See the SP Patch Level section for details.

Reason and prerequisites

Applications that access resources using Servlet API without validating the resource path from the request parameters can expose system resources beyond the scope of the application root context.

CVSS

Score 7.7 / 10 Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

Affected components

• ENGINEAPI versions 7.10 to 7.50
• SAP-JEECOR versions 6.40 to 7.02