Directory traversal in SAP Product and REACH Compliance, SAP security note 1513492

SAP security note 1513492, "Directory traversal in SAP Product and REACH Compliance", is a note. Below are the symptom and SAP recommended solution.

Description

Symptom

Read-only directory traversal: SAP Product and REACH Compliance contains a vulnerability that allows a malicious user to potentially read arbitrary files on the remote server, potentially disclosing confidential information.

Read-write or write directory traversal: SAP Product and REACH Compliance contains a vulnerability that allows a malicious user to potentially write arbitrary files on the remote server, potentially corrupting data or altering system behavior.

Solution

For essential information about the solution, see Note 1497003.

To ensure that the application can access only the files within the designated directories and subdirectories, implement the following logical file names based on the logical path SPRC_HOME_PATH:

• SPRC_IMPORT_DIR: Subdirectories for import files
• SPRC_ARCHIVE_DIR: Subdirectory for files that have been imported
• SPRC_ERROR_DIR: Subdirectory for files that have not yet been imported or have been imported incorrectly

Recommendation for setting up logical file names:

• On the application server, define a root directory for REACH (corresponding to SPRC_HOME_PATH).
• Underneath this, create the import, archive, and error subdirectories (SPRC_IMPORT_DIR, SPRC_ARCHIVE_DIR, and SPRC_ERROR_DIR respectively).
• Create logical files of the type DIR.
• If using IMDS, transfer the existing physical paths of your active IMDS system from the Customizing activity "Specify IMDS System" to the definition of the logical file paths and file names.

Reason and prerequisites

SAP Product and REACH Compliance fails to correctly validate the path used to reference a file read from the remote server. As a result, a malicious user can direct the program to an arbitrary file in the system, disclosing its contents. Additionally, SAP Product and REACH Compliance fails to correctly validate the path to which a user-submitted file is written. This allows a malicious user to potentially overwrite data in the remote system.

Prerequisite: SAP REACH Compliance 1.1 Support Package 04 with Note 1511315 and Note 1497003. SAP Product and REACH Compliance 2.0 Support Package 01 with Note 1511315 and Note 1497003. The corrections provided in both notes are prerequisites for implementing this note.

CVSS

Score 0

References

• 1497003 – Potential directory traversals in applications