SAP security note 1718408, "Directory Traversal in Database Interface". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
A vulnerability exists in SAP Business Warehouse (BW) that allows a malicious user to perform directory traversal through the database interface. This flaw can enable an attacker to write arbitrary files on the remote server, potentially leading to data corruption or alteration of system behavior.
Solution
To address this vulnerability, implement the necessary corrections through the appropriate Support Package for your SAP BW version.
Reason and prerequisites
The issue arises because the BW database interface does not correctly validate the path for user-submitted files. Specifically, the system fails to restrict the directories where files can be written, allowing paths like /usr/sap/put/my_data to be accepted and potentially overwritten by an attacker.
Affected components
- SAP_BW 700 to 702
- SAP_BW 710 to 730
- SAP_BW 731
Full note on SAP: SAP Support Launchpad note 1718408
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].