Directory traversal in ASU Toolbox, SAP security note 1936262

SAP security note 1936262, "Directory Traversal in ASU Toolbox", is a note. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

ASU Toolbox fails to properly validate file paths used to reference files on the remote server. This flaw enables an attacker to direct the program to access arbitrary files within the system, potentially exposing their contents.

Solution

To mitigate this vulnerability, refer to Security Note 1497003 for more information. Implementing the corrections described in this note is a prerequisite for applying SAP Security Note 1936262.

You can apply the necessary corrections by:

• Implementing the corrections as an advance correction.
• Importing the associated Support Package from ST-PI 2008_1.

For manual implementation:

• Use transaction FILE to create the logical file path ASU_TOOLBOX_UPGRADE_PATH with the name "ASU Toolbox Upgrade Path."
• Create the required logical file names as specified in the note.
• Implement the attached program corrections.

Note: Ensure that the logical path is correctly assigned to the physical path on your system to activate the directory traversal check.

CVSS

Score 4.3 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

Affected components

• ST-PI (SV-SMG-ASU) – Service > SAP Solution Manager > Application Specific Upgrade; release versions 2008_1_46C, 2008_1_620, 2008_1_640, 2008_1_700, 2008_1_710