Potential directory traversals in BPCA, SAP security note 1884678

SAP security note 1884678, "Potential directory traversals in BPCA". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

BPCA contains a vulnerability that allows for directory traversal, enabling an attacker to potentially read arbitrary files on the remote server. This can result in the disclosure of confidential information.

Solution

Perform the following manual activities in each system where you transport the note for implementation:

Create Logical File Path

• Check Function Module: Verify if the function module FILE_VALIDATE_NAME exists in the managed system. If it does not exist, you can skip the customizing steps below.
• Create Logical File Path. Transaction: FILE. Procedure: Click on "New Entry". Enter logical file path TBOM_ATRA_FILE_LPATH with the description "Logical path for ATRA files in TBOM recording". Save to a transport request. Assign physical paths to the logical path for different syntax groups: UNIX: /usr/sap/<SYSID>/<INSTANCE>/data/<FILENAME>; AS/400 & MACINTOSH: same as UNIX; WINDOWS NT & DOS: <F=TBOM_ATRA_NAME>\usr\sap\<SYSID>\<INSTANCE>\data\<FILENAME>. Save the changes.

Create Logical File Name

• Transaction: FILE. Procedure: Navigate to "Logical File Name Definition, Cross Client". Click "New Entry". Enter logical file TBOM_ATRA_FILE_LNAME with the description "Logical file name for ATRA file traced in TBOM". Save to the same transport request. Assign the following details: Physical File: <PARAM_1>; Application Area: BC; Logical Path: TBOM_ATRA_FILE_LPATH. Save the changes.

Additional steps

• If the function group E2E_TESTING_DIALOGS does not exist, create it in the package E2E_TESTING and activate it. Create the function module FILENAME_EXIT_TBOM_ATRA_NAME in the function group E2E_TESTING_DIALOGS by copying the interface from FILENAME_EXIT_EXAMPLE. Add the following ABAP code to the function module:

DATA lv_current_param_value TYPE tpfet-pvalue.
DATA lv_parameter_name TYPE tpfet-parname.

lv_parameter_name = 'abap/atrapath'.

CALL 'C_SAPGPARAM'
  ID 'NAME' FIELD lv_parameter_name
  ID 'VALUE' FIELD lv_current_param_value.

output = lv_current_param_value(2).

Activate the function module FILENAME_EXIT_TBOM_ATRA_NAME.

Reason and prerequisites

BPCA fails to correctly validate the file path used to reference a file read from the remote server. As a result, an attacker can potentially direct the program to an arbitrary file in the system, disclosing its contents.

CVSS

Score 2.3 Vector: AV:A/AC:M/AU:S/C:P/I:N/A:N

References

• Potential directory traversals in applications (Note 1497003)

Affected components

• ST-PI 2008_1_46C to 2008_1_46C
• ST-PI 2008_1_620 to 2008_1_620
• ST-PI 2008_1_640 to 2008_1_640
• ST-PI 2008_1_700 to 2008_1_700
• ST-PI 2008_1_710 to 2008_1_710