Skip links
RedRays - Your SAP Security Solution
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

SAP Security on Udemy

Directory Traversal vulnerability in SAP BI Mobile Server, SAP security note 2514475

SAP Note 2514475
SAP Security Note
Medium priority

SAP security note 2514475, “Directory Traversal vulnerability in SAP BI Mobile Server”, is a program error note released on 14.11.2017. Below are the symptom, SAP recommended solution and the affected software components.

ComponentMOB-APP-BI-SRV (Business Mobile > Mobile Applications > Business Intelligence Mobile > Mobile BI Server)
CategoryProgram error
PriorityCorrection with medium priority
TypeSAP Security Note
Version7
StatusReleased for Customer
Released on14.11.2017
LanguageEnglish

Description

Symptom

SAP BI Mobile Server allows an attacker to exploit insufficient validation of path information provided by users, allowing characters that represent “traverse to parent directory” to pass through to the file APIs.

  • An attacker could read the content of arbitrary files on the remote server, exposing sensitive data.
  • An attacker could overwrite, delete, or corrupt arbitrary files on the remote server.

Solution

Since the related functionality has been deprecated, the code has been removed.

CVSS

Score 4.3 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected components

  • SBOP BI PLATFORM SERVERS 4.2: SP002, SP003, SP004, SP005
  • SBOP BI PLATFORM SERVERS 4.1: SP008, SP009, SP010, SP011

Full note on SAP: SAP Support Launchpad note 2514475

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Directory Traversal #SAP BI Mobile Server #Mobile BI #Business Intelligence Mobile

Explore More