Directory traversal in PY-SE-PS, SAP security note 1777988

SAP security note 1777988, "Directory Traversal in PY-SE-PS", is a note released on January 21, 2014. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

The vulnerability in PY-SE-PS allows an attacker to read arbitrary files on the remote server by manipulating the file path used to access files. This can lead to unauthorized disclosure of sensitive information.

Solution

To mitigate this vulnerability, please follow these steps:

1. Apply Prerequisite Notes: SAP Note 1497003, SAP Note 1769611.
2. Implement Support Packages or Corrections: Apply the HR Support Packages referenced in the note or follow the correction instructions provided. Logical file names such as HR_SE_DIR_UPLOAD have been created to validate physical file names. It is recommended to structure directories to reflect user or program names to enhance security.

Reason and prerequisites

The issue arises because PY-SE-PS does not properly validate the file path used to reference files on the server. As a result, attackers can direct the program to access any file within the system, bypassing intended access controls.

References

• SAP Note 1769611 – Directory traversal in PY-SE
• SAP Note 1497003 – Potential directory traversals in applications

Affected components

• EA-HRCSE: 603, 604, 605, 606, 607