Directory Traversal vulnerability in File Interface in SAP Netweaver, SAP security note 2389578

SAP security note 2389578, “Directory Traversal vulnerability in File Interface in SAP Netweaver”. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

The File Interface allows an attacker to exploit insufficient validation of path information provided by users. Characters representing “traverse to parent directory” are passed through to the file APIs.

• Attacker could read content of arbitrary files on the remote server and expose sensitive data
• Attacker could overwrite, delete, or corrupt arbitrary files on the remote server

Solution

This SAP Note provides a correction for the class CL_FS_PATH so that its method IS_SUBPATH_OF and the function modules FILE_VALIDATE_NAME and FILE_GET_NAME_AND_VALIDATE work as expected.

Please implement the Support Package mentioned in this SAP Note or apply the correction instruction.

Reason and prerequisites

The function modules FILE_VALIDATE_NAME and FILE_GET_NAME_AND_VALIDATE do not work properly if they are called for Unix and MS Windows intermixed within the same internal mode. For example, if FILE_VALIDATE_NAME is first called with the parameter OPERATING_SYSTEM = 'Windows NT', then with OPERATING_SYSTEM = 'Linux', and then with OPERATING_SYSTEM = 'Windows NT' again, the function module does not properly determine whether the file name is admissible.

Similarly, the method IS_SUBPATH_OF of the class CL_FS_PATH does not work properly if it is called for Unix and MS Windows intermixed within the same internal mode.

CVSS

Score 5.0 Vector: AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

References

Affected components

• SAP_BASIS 700 to 702
• SAP_BASIS 710 to 711
• SAP_BASIS 730
• SAP_BASIS 731
• SAP_BASIS 740
• SAP_BASIS 750 to 751