SAP security note 1471495, "Directory Traversal in report CRM_LEAS_MIGRATE_BILS", released on December 14, 2010. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
Report CRM_LEAS_MIGRATE_BILLS contains a vulnerability that allows a malicious user to potentially read arbitrary files on the remote server, potentially disclosing confidential information.
Additionally, CRM_LEAS_MIGRATE_BILLS is no longer necessary as there are no customers migrating from SD billing to CRM Billing for the Leasing scenario.
Solution
Apply the provided correction instructions to mitigate the vulnerability. Download Correction Instructions
Reason and prerequisites
The report CRM_LEAS_MIGRATE_BILLS fails to correctly validate the file path used to reference files from the remote server. This allows an attacker to direct the program to access arbitrary files on the system, leading to information disclosure.
Affected components
- BBPCRM: Versions 400, 500, 510, 600, 700, 701
Full note on SAP: SAP Support Launchpad note 1471495
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].