Directory Traversal in SCM-FRE-FRP, SAP security note 1535492

SAP security note 1535492, "Directory Traversal in SCM-FRE-FRP", is a program error note released on 08.02.2011. Below are the symptom and SAP recommended solution.

Description

Symptom

A directory traversal vulnerability has been identified in the SAP component SCM-FRE-FRP. The affected reports are:

• /FRE/FU_TOOLS_TS_FILE_LOAD
• /FRE/FU_TOOLS_FILE_COPY

These vulnerabilities allow malicious users to:

• Read Arbitrary Files: Potentially disclose confidential information by reading arbitrary files on the remote server.
• Write Arbitrary Files: Corrupt data or alter system behavior by writing arbitrary files on the remote server.

Solution

• Prerequisite: Implement the corrections from Note 1497003 which addresses potential directory traversals in applications.
• Logical File Name Configuration:
  • Create the logical file name /FRE/SAF_FILE_PATH_NAME to validate physical file names.
  • Ensure the physical path for the syntax group UNIX for the logical path /FRE/SAF_FILE_PATH is set to /frp/ using transaction FILE.
• Validation Enforcement:
  • Remove any physical path assignments for /FRE/SAF_FILE_PATH to enforce validation logic.
  • Specifically, delete assignments on Windows platforms if present to prevent bypassing validation.

Reason and prerequisites

The reports fail to correctly validate the file paths used when referencing files on the remote server. This lack of validation enables attackers to target arbitrary files on the system.

CVSS

Score 0

References

• Potential directory traversals in applications (1497003)