SAP security note 1573997, "Potential Directory Traversal in Translation Tools", is a note released on August 9, 2011. Below are the symptom and SAP recommended solution.
Description
Symptom
A vulnerability has been identified in the SE63 translation tools functionality of SAP, which allows a malicious user to perform a directory traversal attack. This could enable the attacker to write arbitrary files on the remote server, potentially corrupting data or altering system behavior.
Solution
- For releases higher than 4.6C: Implement the changes provided in the correction instructions attached to this SAP Note. This note disables obsolete code. No testing is required after applying the note.
- For releases lower than or equal to 4.6C: Refer to Note 1497003 for additional information and instructions. The corrections from Note 1497003 are prerequisites for implementing this note.
Reason and prerequisites
Logical file names and paths have been updated to enable the validation of physical file names. Affected programs include RSEXPTRM (Proposal pool export) and RSTEXTA3 (Deletion of unnecessary entries in text tables).
CVSS
Score 0
References
- Potential Directory Traversal for report RSTEXTA3 (Note 1521084)
- Potential directory traversals in applications (Note 1497003)
Full note on SAP: SAP Support Launchpad note 1573997
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].