SAP security note 1510773, “Directory Traversal in RFC modules in classification”. Below are the symptom, reason and prerequisites, the SAP recommended solution and references.
Description
Symptom
The RFC modules in classification (function group CLBA) contain a vulnerability that allows a malicious user to perform directory traversal, potentially writing arbitrary files on the remote server. This can lead to data corruption or alteration of system behavior.
Solution
Implement the changes according to the advanced correction provided in this note. Additionally, refer to Note 1497003, as the program changes from that note are prerequisites for this note.
Reason and prerequisites
The function modules CLBA_CLASSIF_FILE_REMOTE_HOST and CLBA_UPDATE_FILE_REMOTE_HOST do not correctly validate the path where user-submitted files are written, allowing an attacker to overwrite data on the remote system.
References
This note refers to
- 1514017 – Directory Traversal in transactions CL6E and CL6F
- 1512352 – Directory Traversal in batch input reports in class system
- 1509794 – Directory Traversal in transactions CL6E and CL6F
- 1509235 – Directory Traversal in RFC modules in classification
- 1499042 – Directory Traversal in batch input reports in class system
- 1497003 – Potential directory traversals in applications
Full note on SAP: SAP Support Launchpad note 1510773
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].