Directory Traversal vulnerability in ABAP Server File Interface, SAP security note 2643447

SAP security note 2643447, "Directory Traversal Vulnerability in ABAP Server File Interface". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

SAP Security Note 2643447 addresses a Directory Traversal vulnerability in the ABAP Server File Interface. This vulnerability allows an attacker to exploit insufficient validation of path information provided by users, enabling characters that represent traversal to parent directories to be passed through to the file APIs.

Impacts of Directory Traversal Vulnerability:

• Data Exposure: Attackers could read the content of arbitrary files on the remote server, potentially exposing sensitive data.
• Data Integrity: Attackers could overwrite, delete, or corrupt arbitrary files on the remote server.

Solution

To mitigate this vulnerability, apply the correction instructions provided in this SAP Note or the corresponding Support Package. These corrections ensure that:

• Paths in cases 2.a) and 2.b) are correctly recognized as equal.
• The behavior in cases 1) and 2.c) aligns with expected security measures.
• For case 2.d), introduce the optional parameter ignore_uncw_prefix in the methods IS_EQUAL and IS_SUBPATH_OF to discard the \\?\ prefix when necessary.

Reason and prerequisites

Several issues contribute to this vulnerability:

• The method IS_SUBPATH_OF in class CL_FS_PATH may fail to correctly convert relative paths to absolute paths in rare cases, leading to incorrect results.
• On Microsoft Windows systems, certain path formats are not correctly recognized as equal by the methods IS_EQUAL and IS_SUBPATH_OF: paths starting with a single backslash (\) refer to the current drive, causing different path representations to point to the same file; dots after directory or file names are ignored, leading to equivalent but syntactically different paths; paths beginning with the prefix \\?\ may not be handled correctly, affecting hostname and drive letter retrieval, and recognition of equivalent paths.

CVSS

Score 6.3 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References

• Update 1 to Security Note 2643447
• Error in SPAM when loading EPS files
• Problems with SAP Note 2643447 when installing a support package

Affected components

• SAP_BASIS (versions 700 to 753)