SREPdata import of eletronic time register – Dir. Traversal, SAP security note 1619880

SAP security note 1619880, “SREP: Data Import of Electronic Time Register – Directory Traversal Vulnerability”. Below are the symptom and SAP recommended solution.

Description

Symptom

The Data import of electronic time register (HBRTMIF0) report contains a vulnerability allowing a malicious user to potentially read arbitrary files on the remote server. This could lead to disclosing confidential information, corrupting data, or altering system behavior.

Solution

The HBRTMIF0 report has been updated to validate input files properly. This improvement is included in an HR Support Package.

Reason and prerequisites

The HBRTMIF0 report does not correctly validate the file path used to reference files read from the remote server. Consequently, a malicious user can direct the program to any other file in the system, potentially disclosing its contents.