[CVE-2021-44232] Directory Traversal vulnerability in SAF-T Framework, SAP security note 3124094

SAP security note 3124094, "[CVE-2021-44232] Directory Traversal Vulnerability in SAF-T Framework", is a program error note released on 14.12.2021. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

A Directory Traversal vulnerability (CVE-2021-44232) has been identified in the SAF-T Framework Transaction SAFTN_G within SAP systems. This vulnerability allows an attacker to exploit insufficient validation of path information provided by a normal user, leading to full server directory access. While the attacker can view the entire filesystem structure, they cannot overwrite, delete, or corrupt arbitrary files on the server.

Solution

The following measures have been implemented to mitigate this vulnerability:

• Removal of F4 Search Help: the F4 search help for the File Name field in transaction SAFTN_G has been removed to prevent unauthorized path access.

Safe file name entry options:

• Option 1: manually enter the full path and file name (for example, /tmp/saft.xml) in the File Name field.
• Option 2: assign a Physical Path to Logical File Path "SAFTN_FILE_PATH" and assign a Physical File Name to Logical File Name "SAFTN_FILE_NAME" using the FILE transaction in advance.
• Option 3: assign a Physical Path to Logical File Path "SAFTN_FILE_PATH" in advance. In transaction SAFTN_G, enter only the file name without the path (for example, saft.xml).

For detailed instructions, refer to SAP Note 3124094.

CVSS

Score 7.7

Affected components

• SAP_APPL: 600, 602, 603, 604, 605, 606
• SAP_FIN: 617, 618, 720, 730
• S4CORE: 101, 102, 103, 104, 105, 106