SAP SAPCAR Directory Traversal Vulnerability Allowing Arbitrary File Overwrite

A directory traversal vulnerability has been identified in SAPCAR, affecting the way file paths are sanitized during the extraction of SAPCAR archives. This flaw allows an attacker to create a malicious archive with directory traversal sequences. When a high-privileged user extracts this archive, SAPCAR processes it in a way that files are extracted outside the intended directory, potentially overwriting files in arbitrary locations. This vulnerability poses a significant risk to the integrity and availability of the application.

Impact

Exploitation of this vulnerability could lead to unauthorized file overwrites, causing potential disruption or corruption of application data.

Remediation

Users are advised to review and implement the SAP Security Note associated with this vulnerability. This can be done through the SAP Security Patch Day, which occurs on the second Tuesday of each month.