Directory Traversal in ABAP Debugger, SAP security note 1631460

SAP security note 1631460, "Directory Traversal in ABAP Debugger". Below are the symptom and SAP recommended solution.

Description

Symptom

ABAP Debugger contains a vulnerability through which an attacker can potentially write arbitrary files to the remote server, possibly corrupting data or altering system behavior.

Solution

The correction withdraws the user input and calculates the file names internally. Please apply the support package mentioned in this note at least or implement the correction instruction.

Reason and prerequisites

ABAP Debugger fails to correctly validate the path to which a user-submitted file is written. As a result, an attacker can potentially overwrite data in the remote system.

References

• Automatic checks for security notes using RSECNOTE (outdated) by SV-SMG-SER