CVE-2018-2380 Directory Traversal vulnerability in Internet Sales, SAP security note 2547431

SAP security note 2547431, “[CVE-2018-2380] Directory Traversal vulnerability in Internet Sales”. Below are the symptom and SAP recommended solution.

Description

Symptom

Internet Sales allows an attacker to exploit insufficient validation of path information provided by users, allowing characters representing ‘traverse to parent directory’ to be passed to the file APIs.

Impacts of Directory Traversal Vulnerability:

• Confidentiality: An attacker could read the content of arbitrary files on the remote server and expose sensitive data.
• Integrity: An attacker could overwrite, delete, or corrupt arbitrary files on the remote server.

Solution

Internet Sales now properly checks the log paths submitted by the user and disallows arbitrary log file locations and extensions.

To resolve this issue, apply the Support Package patch level attached to this note. For more information about applying Java patches, refer to Note 877887. See Note 1546959 for information about the patch strategy.

Reason and prerequisites

Reason: Internet Sales did not properly check the provided log file destination.

Prerequisites: An attacker needs to be logged in as an admin user.

CVSS

Score 6.6 Vector: AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

References

• Note 1546959 – Patch strategies for SAP E-Commerce solutions
• Note 877887 – Installing Patches for CRM Java Components and FSCM BD