Directory traversal in BC-SRV-KPR-CS, SAP security note 1767956

SAP security note 1767956, "Directory traversal in BC-SRV-KPR-CS", is a note released on May 23, 2014. Below are the symptom and SAP recommended solution.

Description

Symptom

A vulnerability exists in BC-SRV-KPR-CS that allows a malicious user to perform directory traversal. This can enable unauthorized reading of arbitrary files on the remote server, potentially disclosing confidential information, and writing arbitrary files, which may corrupt data or alter system behavior.

Solution

To mitigate this vulnerability, disable directory browsing in your web servers as follows:

For IIS 7:

• Open IIS Manager and navigate to the desired level.
• In Features View, double-click Directory Browsing.
• In the Actions pane, click Disable.

For IIS 5.1 or IIS6:

• Open IIS Manager.
• Right-click your SAP Content Server website (e.g., SAP_Content_Server) and select Properties.
• Click the Home Directory tab and uncheck Directory Browsing.
• Click Apply and OK.
• Restart IIS to apply changes.

For Apache:

• Locate and open the httpd.conf file.
• Find the <Directory “/u01/app/apache/htdocs”> section.
• Change Options Indexes FollowSymLinks to Options -Indexes FollowSymLinks.
• Save the file and restart Apache to apply changes.

Reason and prerequisites

The issue arises because BC-SRV-KPR-CS does not properly validate the file path used to access files on the remote server. This lack of validation allows attackers to manipulate the path to access or overwrite arbitrary files within the system.

CVSS

Score 6.5 Vector: AV:N/AC:L/AU:S/C:P/I:P/A:P