SAP security note 1504497, "COPA: Potential Directory Traversal", is a note. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
A potential directory traversal vulnerability exists in the CO-PA module. This vulnerability may allow a malicious user to read arbitrary files on the remote server, potentially disclosing confidential information. Additionally, some programs may allow writing arbitrary files, which could corrupt data or alter system behavior.
- Potential Directory Traversal in module CO-PA
Solution
Refer to SAP Note 1497003 for additional information and instructions. The following logical file names have been created to validate physical file names:
- COPA_REOCE4 used in program RKEREOCE4_EXTRACT
- COPA_RKEHOH10 used in program RKEHOH10
- COPA_RKEXD000 used in program RKEXD000
- COPA_KEFC_IN and COPA_KEFC_OUT used in transaction KEFC
- COPA_KEDA used in transaction KEDA
These logical file names utilize the logical file path COPA_ROOT.
Reason and prerequisites
The programs addressed in this correction contain vulnerabilities that could be exploited to read or write arbitrary files on the server. Implementing this note requires the corrections from SAP Note 1497003 as a prerequisite.
References
- SAP Note 1497003: Potential directory traversals in applications
- SAP Note 1403572: Missing authorization check in CO-PA
- SAP Note 1322707: KEDA for account-based summarization levels
Affected components
- SAP_APPL 31I to 605
- SAP_BASIS 46B to 710
Full note on SAP: SAP Support Launchpad note 1504497
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].