Directory traversal with unauthorized modification in BW, SAP security note 1658759

SAP security note 1658759, “Directory traversal with unauthorized modification in BW”, is a program error note released on 08.05.2012. Below are the symptom and SAP recommended solution.

Description

Symptom

BW-BEX-ET-WEB contains a vulnerability that allows a malicious user to read arbitrary files. This can be exploited to modify displayed application content without authorization and potentially obtain authentication information from other legitimate users.

Solution

Implement the correction by updating the HTTP_WHITELIST table as described in SAP Note 1594641 for an entry of type 01 for Portal CSS Theme-URL. If the provided stylesheet URL is not in the whitelist, an ABAP runtime error will be generated. Customers must add the allowed URLs for the stylesheet to the HTTP_WHITELIST table.

Before proceeding, ensure you check SAP Note 875986 for transaction SNOTE.

Reason and prerequisites

Pages within BW-BEX-ET-WEB fail to correctly validate the URL path used to reference a file. As a result, a malicious user can direct the program to an arbitrary file in the system, leading to reflected XSS issues. This vulnerability can be used to deface or modify displayed content, steal user authentication information, and potentially allow impersonation of users, including administrators, thereby compromising application security.