SAP security note 1522643, "Directory Traversal in Dynpro Processing", is a note. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
Dynpro Processing contains a vulnerability through which a malicious user can potentially read arbitrary files on the remote server, possibly disclosing confidential information.
Solution
Please apply the support package mentioned in this note. Alternatively, apply the correction instruction of the note.
Reason and prerequisites
Dynpro Processing fails to correctly validate the path with which a file that is read from the remote server is referenced. Through this, an attacker can potentially point the program to an arbitrary other file on the system, disclosing its contents.
References
Affected components
- SAP_APPL 31I
- SAP_APPL 40B
- SAP_APPL 45B
- SAP_BASIS 46B to 46C
- SAP_BASIS 610 to 640
- SAP_BASIS 700 to 702
- SAP_BASIS 710 to 730
- SAP_BASIS 72L
Full note on SAP: SAP Support Launchpad note 1522643
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].