Medium priority
SAP security note 1497170, "Directory Traversal in Archivelink function modules", is a program error note released on January 11, 2011. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
Several Archivelink Function Modules are susceptible to directory traversal attacks. An attacker exploiting this vulnerability can write arbitrary files to the remote server, compromising data integrity and system functionality.
Solution
Apply Prerequisite Note: Ensure that SAP Security Note 1497003 is implemented. This note contains necessary corrections that are mandatory for the successful application of Note 1497170.
Reason and prerequisites
The affected function modules fail to properly validate the path where user-submitted files are written. This lack of validation enables attackers to overwrite existing data on the remote system.
Prerequisite: Implementation of SAP Security Note 1497003 is required before applying this note.
Affected components
- SAP_BASIS 46C to 46C
- SAP_BASIS 620 to 640
- SAP_BASIS 700 to 702
- SAP_BASIS 710 to 730
Full note on SAP: SAP Support Launchpad note 1497170
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].