Skip links
RedRays - Your SAP Security Solution
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

SAP Security on Udemy

Directory traversal in BW, SAP security note 1575722

SAP Note 1575722
SAP Security Note
High priority

SAP security note 1575722, "Directory traversal in BW", is a program error note released on 09.08.2011. Below are the symptom and SAP recommended solution.

ComponentSAP Business Warehouse > Business Explorer > OLAP Technology > Interface to Database
CategoryProgram error
PriorityCorrection with high priority
TypeSAP Security Note
Version3
StatusReleased for Customer
Released on09.08.2011
LanguageEnglish (Master Language: German)

Description

Symptom

BW contains a vulnerability through which a malicious user can potentially write arbitrary files on the remote server, possibly corrupting data or altering system behavior.

Solution

Import the relevant Support Package for your BW system version:

  • SAP NetWeaver BW 7.00: import Support Package 28 (SAPKW70028).
  • SAP NetWeaver BW 7.01: import Support Package 11 (SAPKW70111).
  • SAP NetWeaver BW 7.02: import Support Package 10 (SAPKW70210).
  • SAP NetWeaver BW 7.11: import Support Package 8 (SAPKW71108).
  • SAP NetWeaver BW 7.30: import Support Package 05 (SAPKW73005).

After importing the Support Package, perform the following manual configurations using transaction /NFILE:

  • Logical File Path Definition: add new entries for BW_RSDR with the name "BW DataManager".
  • Assignment of Physical Paths to Logical Path: UNIX /tmp/<FILENAME>; Windows NT <P=DIR_TEMP>\<FILENAME>.
  • Logical File Name Definition, Cross-Client: add a new entry for BW_RSDR with name "BW DataManager", physical file empty, data format DIR, application area BW, logical path BW_RSDR.

Before implementing the corrections, ensure that you specify the return type in transaction /NLISTCUBE. For example, if "Store in file (appl. server)" is selected, you can specify any directory. After applying the corrections, only the specified directories (/tmp/<FILENAME> for UNIX and <P=DIR_TEMP>\<FILENAME> for Windows NT) can be used.

Reason and prerequisites

BW fails to correctly validate the path to which a user-submitted file is written. As a result, a malicious user can potentially overwrite data in the remote system.

References

Full note on SAP: SAP Support Launchpad note 1575722

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Directory traversal #BW_RSDR #LISTCUBE #FILE_VALIDATE_NAME

Explore More