Directory traversal when creating conditions (batch input), SAP security note 1620983

SAP security note 1620983, "Directory traversal when creating conditions (batch input)". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

Creating a batch input session for condition records (report RV14BTCI) contains a vulnerability through which an attacker can potentially read arbitrary files on the remote server, possibly disclosing confidential information.

Solution

For additional information and instructions, see Note 1497003 and Note 1605703. The corrections from these notes are a prerequisite for implementing this note.

• Call transaction FILE.
• In the tree, select Logical File Path Definition and choose New Entries.
• Enter the logical file path CONDITION_BATCH_ROOT with the name "Condition records – file path".
• Save your new entry.
• In transaction FILE, select Logical File Name Definition, Cross-Client and choose New Entries.
• Enter the following values: Logical file CONDITION_BATCH_FILENAME; Name Condition records – file name for batch file; Data format DIR; Application area SD; Logical path CONDITION_BATCH_ROOT.
• Save your new entry.

Reason and prerequisites

The report RV14BTCI fails to correctly validate the path that is used to reference a file that is read from the remote server. As a result, an attacker can potentially direct the program to an arbitrary other file in the system, disclosing its contents.

References

• Note 1605703 – RSFILECR: Potential directory traversals in applications
• Note 1497003 – Potential directory traversals in applications
• Note 993499

Affected components

• SAP_APPL 31I to 31I
• SAP_APPL 40B to 40B
• SAP_APPL 45B to 45B
• SAP_APPL 46B to 46B
• SAP_APPL 46C to 46C
• SAP_APPL 470 to 470
• SAP_APPL 500 to 500
• SAP_APPL 600 to 600
• SAP_APPL 602 to 602
• SAP_APPL 603 to 603
• SAP_APPL 604 to 604
• SAP_APPL 605 to 605
• SAP_APPL 606 to 606