SAP security note 2806198, “[CVE-2020-6203] Path Manipulation in SAP NetWeaver UDDI Server (Services Registry)”. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
Services Registry allows an attacker to exploit insufficient validation of path information provided by users. Characters representing ‘traverse to parent directory’ are passed through to the file APIs.
Some well-known impacts of Directory Traversal vulnerability are:
- Attacker could read content of arbitrary files on the remote server and expose sensitive data
- Attacker could overwrite, delete, or corrupt arbitrary files on the remote server
Solution
Implement the Support Packages and Patches referenced by this SAP Note.
Reason and prerequisites
Services Registry fails to correctly validate the path specified in the importing UDDI content and can reference a file that exists on the remote server. As a result, an attacker can potentially direct the program to an arbitrary other file in the system, overwriting its content.
CVSS
Score 9.1 Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
References
Affected components
- SR-UI 7.11
- SR-UI 7.20
- SR-UI 7.30
- SR-UI 7.31
- SR-UI 7.40
- SR-UI 7.50
Full note on SAP: SAP Support Launchpad note 2806198
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].