SAP Security Note
High priority
SAP security note 1487019, “Directory Traversal in RM_INITIAL_DATA_LOAD”, is a note released on December 14, 2010. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
A critical vulnerability has been identified in the programs RM_RECIPE_SAMPLE_DATA and RM_INITIAL_DATA_LOAD within the Product Lifecycle Management > Recipe Management (PLM-RM) component. This directory traversal flaw allows malicious users to write arbitrary files on the remote server, potentially leading to data corruption or altered system behavior.
The programs fail to properly validate the file path where user-submitted files are written. This oversight allows attackers to overwrite data on the remote system, posing significant security risks.
Solution
- Refer to SAP Note 1497003 for additional information and instructions. The corrections from this note are prerequisites for implementing the solution for this vulnerability.
- Implement the source code changes by following the advance corrections described in the prerequisite note. After applying the corrections, the program RM_RECIPE_SAMPLE_DATA will no longer save sample data on the application server; instead, sample data can still be downloaded to the presentation server.
References
Affected components
- EA-APPL: Versions 603, 604, 605
- SAP_BASIS: Versions 700, 701, 702 to 710 (related to prerequisite note 1497003)
Full note on SAP: SAP Support Launchpad note 1487019
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
