Directory traversal in FI-CA-BI, SAP security note 1587411

SAP security note 1587411, "Directory traversal in FI-CA-BI", addresses a security vulnerability affecting SAP systems. Below are the symptom and SAP recommended solution.

Description

Symptom

Potential directory traversal in FI-CA-BI.

• Unauthorized reading of confidential files.
• Unauthorized writing of files, potentially corrupting data or altering system behavior.

Solution

1. Prerequisite: implement the corrections from SAP Note 1497003 before applying this note.
2. Logical File Configuration: use transaction FILE to maintain logical file paths and names. Create logical file path FI-CA-BI-SAMPLE-DIR. Define logical file names such as FI-CA-BI-SAMPLE for secure separation of data.
3. Message Classes and Authorization Objects: define necessary message classes in FKKBIX. Maintain the authorization object F_KKBIXTST with specific permissions.

Ensure that the necessary prerequisite notes are applied to your system before implementing this security note. Refer to the Prerequisites section for more details.

References

• SAP Note 1497003: Potential directory traversals in applications