Directory Traversal vulnerability in MDG Data Export, SAP security note 2328182

SAP security note 2328182, "Directory Traversal Vulnerability in MDG Data Export". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

The MDG Data Export feature insufficiently validates path information provided by users. Specifically, characters that represent directory traversal (e.g., ../) are passed through to the file APIs, enabling attackers to navigate to parent directories on the server.

Potential impacts:

• Data Exposure: Attackers can read the contents of arbitrary files on the remote server, exposing sensitive information.
• Data Integrity: Attackers can overwrite, delete, or corrupt arbitrary files on the remote server.

Solution

To mitigate this vulnerability, the application now performs proper validation of user-submitted paths and disallows arbitrary file reads by introducing the Logical File Name MDG_EXPORT_IMPORT. This logical file name should specify the directory path designated for data exports.

• Apply Support Packages and Patches: implement the Support Packages and Patches referenced in this SAP Note. For detailed instructions, refer to SAP Note 1497003.
• Configure Logical File Paths: navigate to transaction FILE and create new table entries for logical file paths and file names (Logical file path: MDG_EXPORT_IMPORT; Description: MDG Export/Import logical file). Save your changes.
• Define Logical File Name: in the dialog structure, double-click on "Logical File Name Definition, Cross-Client" and create a new entry (Logical file: MDG_EXPORT_IMPORT; Description: MDG Export/Import logical file; Physical file: "<please maintain your customer-specific path here>"; Data format: DIR; Application Area: CA; Logical path: MDG_EXPORT_IMPORT). Save your changes.

CVSS

Score 0

References

• 1497003 – Potential directory traversals in applications

Affected components

• S4CORE 100
• SAP_BS_FND 731
• SAP_BS_FND 746
• SAP_BS_FND 747
• SAP_BS_FND 748