Directory traversal in the site master import/export, SAP security note 1592470

SAP security note 1592470, "Directory Traversal Vulnerability in Site Master Import/Export", was released on 08.11.2011. Below are the symptom and SAP recommended solution.

Description

Symptom

A potential directory traversal vulnerability exists in the site master import/export functionality (IS-R-BD-SIT).

Solution

1. Apply Prerequisite Corrections: ensure Note 1497003 is implemented.
2. Configure Logical File Names: logical file name ISR_BD_SITE_IMP_EXP_FILE enables validation of physical file names. Programs using this logical file name: RWBTRAEX, RWBTRAIM.
3. Recommendations for setting up logical file names: create a directory structure that includes the user name and/or program name to securely separate data; use predefined parameters for physical file names as documented in transaction FILE (F1 help for the physical path).
4. Resulting file path for validation: path /usr/sap/PRD/SYS/global/load, default file name /usr/sap/PRD/SYS/global/load/BTRA. Without physical path maintenance, the system defaults to /usr/sap/trans/tmp/BTRA with no file path check, allowing arbitrary paths.

Reason and prerequisites

The programs specified in the correction instructions contain vulnerabilities that allow a malicious user to:

• Read Arbitrary Files: potentially disclose confidential information by reading arbitrary files on the remote server.
• Write Arbitrary Files: possibly corrupt data or alter system behavior by writing arbitrary files on the remote server.

Prerequisite: implement the corrections from Note 1497003. These corrections are essential before applying this note.

References

• Note 1497003: Potential directory traversals in applications