SAP security note 2562089, “[CVE-2018-2367] Directory Traversal Vulnerability in ABAP File Interface”. Below are the symptom and SAP recommended solution.
Description
Symptom
ABAP File Interface allows an attacker to exploit insufficient validation of path information provided by users, enabling characters representing ‘traverse to parent directory’ to pass through to the file APIs.
Impacts of Directory Traversal Vulnerability:
- Confidentiality: Attacker could read content of arbitrary files on the remote server and expose sensitive data.
- Integrity: Attacker could overwrite, delete, or corrupt arbitrary files on the remote server.
Solution
To change the behavior so that relative paths breaking out of the working directory are converted into absolute paths, follow these steps:
- Implement the correction instructions provided in SAP Note 2562089 or the corresponding Support Package. For compatibility reasons, the correction itself does not change the behavior; the manual steps below are necessary.
- Set the profile parameter
abap/path_normalization(described in SAP Note 2551541) to the value “ext”. - With relative paths now being converted into absolute paths, verify if these paths are already maintained in table SPTH. If missing, maintain these absolute paths in table SPTH using transaction SM30.
Additional rule for Windows: if the ABAP application server runs on Microsoft Windows, a relative path with a drive letter different from the current working directory’s drive letter is rejected. This behavior is equivalent to failing the AUTHORITY-CHECK with the authority object ‘S_PATH’.
To facilitate maintaining absolute paths in SPTH, the correction allows the use of variables such as <P=DIR_INSTANCE>/some_subdir/ and <P=DIR_DATA>/Some_Application_<P=_SY_MANDT_>/. Supported variables are DIR_CCMS, DIR_DATA, DIR_EXECUTABLE, DIR_GLOBAL, DIR_HOME, DIR_INSTALL, DIR_INSTANCE, DIR_LOGGING, DIR_PERF, DIR_PROFILE, DIR_TEMP, DIR_TRANS, INSTANCE_NAME, SAPLOCALHOST, SAPSYSTEM, SAPSYSTEMNAME and _SY_MANDT_. Values of these variables can be displayed in transactions RZ11 and AL11, except for _SY_MANDT_, which represents the client of the user session. Using these variables does not require setting the profile parameter abap/path_normalization to “ext”.
Reason and prerequisites
This security note is relevant only if file paths have been maintained in the database table SPTH.
ABAP applications can use relative paths to access files in or underneath the working directory (DIR_HOME in Transaction AL11). These relative paths can be maintained in the table SPTH and are not converted into absolute paths. This is critical if a relative path breaks out of the working directory. If the corresponding absolute path has been maintained in table SPTH, this SPTH entry will not be used.
CVSS
Score 6.6 Vector: AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
References
Full note on SAP: SAP Support Launchpad note 2562089
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].