SAP Security Note
High priority
SAP security note 1594359, “FI: Potential Directory Traversal – Mexico”, is a program error note released on 08.11.2011. Below are the symptom and SAP recommended solution.
Description
Symptom
Potential directory traversal in the following component: XX-CSC-MX.
Solution
Refer to SAP Note 1497003 for additional information and instructions. Implementing the corrections from this note is a prerequisite for applying this security note.
The applications RFIDMXFORMAT29, RFIDMXCTOP, and RFIDMXVTOP pass an additional parameter (parameter_1 – sy-cprog) to the Function Module FILE_VALIDATE_NAME. This allows customers to configure the physical paths for the logical file name FI_MX_FILE_PATH.
Reason and prerequisites
The programs contained in the correction instructions have vulnerabilities that allow malicious users to read arbitrary files on the remote server, potentially disclosing confidential information. Some programs also allow writing arbitrary files on the remote server, which can lead to data corruption or altered system behavior.
References
This note refers to
Full note on SAP: SAP Support Launchpad note 1594359
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].