CVE-2024-27901: SAP Asset Accounting Path Traversal Flaw

CVE-2024-27901 Overview

CVE-2024-27901 is a path traversal vulnerability [CWE-35] in SAP Asset Accounting. The flaw stems from insufficient validation of path information supplied by users before it is passed to file APIs. An authenticated attacker with high privileges can traverse the file system and access, modify, or delete files outside the intended directories. Successful exploitation impacts the confidentiality, integrity, and availability of the application. SAP addressed the issue in the April 2024 Security Patch Day release documented in SAP Note #3438234.

Critical Impact
An authenticated attacker with high privileges can leverage path traversal in SAP Asset Accounting to read, alter, or delete sensitive files, compromising the confidentiality, integrity, and availability of the application.

Affected Products

SAP Asset Accounting (see SAP Note #3438234 for exact component versions)
SAP S/4HANA deployments that include the Asset Accounting module
SAP ERP deployments that include the Asset Accounting module

Discovery Timeline

2024-04-09 - CVE-2024-27901 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-27901

Vulnerability Analysis

The vulnerability is a path traversal weakness classified under [CWE-35] (Path Traversal: .../...//). SAP Asset Accounting accepts file path parameters from authenticated users and forwards them to internal file APIs without adequate sanitization. Because the application does not canonicalize or restrict the supplied path, an attacker can inject traversal sequences to escape the intended directory context.

Exploitation requires network access and pre-existing high-privilege credentials, but does not require user interaction. Once triggered, the flaw allows the attacker to interact with arbitrary files accessible to the SAP application service account. This can result in disclosure of configuration data, tampering with business records, or destruction of files that the Asset Accounting service depends on.

Root Cause

The root cause is insufficient validation of user-supplied path information before it is passed to file API calls. The application does not reject or normalize traversal sequences such as ../, absolute paths, or platform-specific path separators. As a result, unsanitized input controls the target of downstream file read, write, and delete operations.

Attack Vector

The attack vector is network-based against the SAP Asset Accounting application. An attacker authenticates using an account with high privileges within the SAP environment. The attacker then submits a crafted request containing traversal characters in a file-path parameter to an affected function or transaction. The application processes the path without adequate checks and performs file operations at the attacker-controlled location on the SAP host file system.

No verified public exploit code is available. See SAP Note #3438234 for vendor technical details.

Detection Methods for CVE-2024-27901

Indicators of Compromise

Requests to SAP Asset Accounting transactions or function modules containing traversal sequences such as ../, ..\, or URL-encoded variants like %2e%2e%2f.
Access by SAP application accounts to files outside standard Asset Accounting working directories on the host operating system.
Unexpected creation, modification, or deletion of files under SAP directories by high-privilege user sessions.

Detection Strategies

Enable SAP Security Audit Log (SM19/SM20) and monitor high-privilege user activity in Asset Accounting transactions for anomalous file path parameters.
Inspect application and web dispatcher logs for path traversal patterns in request parameters targeting Asset Accounting endpoints.
Correlate file system events on SAP hosts with SAP user session activity to identify file access outside expected paths.

Monitoring Recommendations

Baseline normal file paths accessed by Asset Accounting processes and alert on deviations.
Track use of privileged SAP accounts and flag interactive sessions performing file operations from Asset Accounting modules.
Forward SAP audit logs and host file integrity events to a centralized analytics platform for correlation and long-term retention.

How to Mitigate CVE-2024-27901

Immediate Actions Required

Apply the SAP-provided fix referenced in SAP Note #3438234 to all affected SAP Asset Accounting installations.
Review and reduce the number of accounts holding high-privilege roles in Asset Accounting, applying least privilege.
Audit recent activity of privileged SAP users for signs of path traversal exploitation prior to patching.

Patch Information

SAP released a corrective patch as part of the April 2024 Security Patch Day. Refer to SAP Note #3438234 for the specific component versions, support package levels, and installation instructions. Additional context is available in the SAP Security Notes Overview.

Workarounds

Restrict network access to SAP Asset Accounting interfaces so that only trusted administrative networks can reach the affected functionality.
Enforce strict role assignment and segregation of duties to limit which accounts can invoke file-path parameters in Asset Accounting.
Enable and actively review the SAP Security Audit Log for suspicious use of Asset Accounting transactions until the patch is deployed.

bash

# Configuration example: enable SAP Security Audit Log for high-privilege users
# In transaction SM19, create an audit profile that captures:
#   - Successful and failed transaction starts for Asset Accounting (FI-AA) transactions
#   - RFC function module calls by high-privilege users
#   - Report starts referencing file path parameters
# Activate the profile via SM19 and review events daily in SM20.