Directory traversal in Web Container, SAP security note 1753378

SAP security note 1753378, "Directory traversal in Web Container". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

Potential directory traversal in the Web Container.

Solution

I. Update your AS Java to a fixed version and SP. For more details see the “SP Patch Level” section of this note.

II. Change the value of the property DirectoryStructureProtection of the HTTP Provider service (http) to true by following the steps:

For SAP NetWeaver 7.10 and up

• Open Configtool.
• Choose View -> Expert mode should be checked.
• Navigate to Template -> instance -> services -> http.
• Choose the DirectoryStructureProtection property.
• In the Value field type true.
• Click Set Custom Value button.
• Press the Save button (diskette icon) in the top-left corner.
• Restart the server nodes for changes to take effect.

For lower versions

• Open Configtool.
• Go to cluster-data -> Global server configuration -> services -> http.
• Choose the DirectoryStructureProtection property.
• In the Value field type true.
• Press the Set button in the top-right corner.
• Press the Save button (diskette icon) in the top-left corner.
• Confirm all popups.
• Restart the server nodes for changes to take effect.

Reason and prerequisites

The programs specified in the correction instructions contain vulnerabilities through which an attacker can potentially read arbitrary files under one specific directory on the remote server, possibly disclosing confidential information.

CVSS

Score 5.3 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected components

• SAP-JEE 6.40
• SAP-JEECOR 6.40, 7.00, 7.01 – 7.02
• SERVERCORE 7.10 – 7.31