Security Note Restriction on attachment file types in BPM, SAP security note 1427695

SAP security note 1427695, "Security Note: Restriction on attachment file types in BPM", released on March 9, 2010. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

Prior to SAP NW BPM 7.20 SP0, there was no mechanism to restrict the types of files that could be attached to BPM tasks and processes. This posed a risk of attaching potentially dangerous files with active content aimed at compromising users.

Solution

To mitigate this risk, SAP introduced the ability to restrict attachment file types starting with SAP NW BPM 7.20. The key steps to implement this restriction are:

• Upgrade to SAP NW BPM 7.20 or a later version.
• Configure File Type Restrictions: log in to SAP NetWeaver Administrator, navigate to Configuration Management, then Infrastructure, then Java System Properties. Select the Applications tab and choose the tc~bpem~base~ear application. Modify the context.attachments.extensions property by entering a comma-separated list of allowed file extensions (e.g., txt, jpg, zip, doc). Save the changes to enforce the restrictions.

Only files with the specified extensions will be permitted as attachments to BPM tasks and processes. If no value is set for context.attachments.extensions, there will be no file type restrictions, and all file types will be allowed.

Affected components

• BPEM-WDUI: Version 7.20 and above
• BPEM-BASE: Version 7.20 and above