Directory Traversal vulnerability in SAP Enterprise Architecture Designer v1.0 SP04, SAP security note 2709897

SAP security note 2709897, "Directory Traversal vulnerability in SAP Enterprise Architecture Designer v1.0 SP04", is a note. Below are the symptom and SAP recommended solution.

Description

Symptom

SAP Enterprise Architecture Designer v1.0 SP04 allows an authenticated attacker to exploit insufficient validation of path information provided by users, thus characters representing 'traverse to parent directory' are passed through to the file APIs.

This could be achieved by injecting a maliciously crafted Zip file ("Zip Slip" CVE-2018-1002204).

Some well-known impacts of the Directory Traversal vulnerability include:

• Overwriting, deleting, or corrupting arbitrary files on the remote server

Solution

• Verify Affected Versions:
  • Log in with the XS client tool and issue the xs lc command.
  • The installed version should be listed in the following format:
    Found software components:
    software component version
    ———————————-
    XSAC_HANA_EA_D (sap.com) 1.X.Y
  • X is the service pack number.
  • Y is the patch level.
  • Versions below 1.4.3 are affected.
• Apply the Fix:
  • Apply PL03: "SAP Enterprise Architecture Designer v1.0 SP04 PL03" or later versions.
  • This fix upgrades the zip processing library to a version not vulnerable to CVE-2018-1002204.
• Additional Fixes in PL03:
  • SECURITY: Update Apache CXF to 3.2.6 to address CVE-2018-8039.
  • SECURITY: Update the adm-zip npm package to mitigate "Zip Slip" CVE-2018-1002204.
  • LDAP Connection: Resolves issues where some users cannot connect.

Reason and prerequisites

SAP Enterprise Architecture Designer for SAP HANA is an application on SAP HANA extended application services, advanced model. Only servers having SAP HANA extended application services and SAP Enterprise Architecture Designer for SAP HANA installed are affected by the described issue.

CVSS

Score 5.0 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N