SAP security note 1775317, "Directory traversal in IS-PS-CA", is a security note. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
IS-PS-CA contains a vulnerability through which an attacker can potentially write arbitrary files to the remote server, possibly corrupting data or altering system behavior.
Solution
Implement the correction instructions relevant for your release.
SAP Note 1497003 contains further information and instructions. The corrections from SAP Note 1497003 are a prerequisite for implementing this SAP Note.
Logical file names used in this solution:
- FI-CA-COL-SUB
Logical file names used in this solution are created with the correction from SAP Note 1584972. Therefore, SAP Note 1584972 is a prerequisite for the correction from this SAP Note. The logical file name FI-CA-COL-SUB is used in the correction again.
Reason and prerequisites
FI-CA fails to correctly validate the path to which a user-submitted file is written. As a result, an attacker can potentially overwrite data in the remote system.
References
- SAP Note 1624291 – Syntax error when implementing a security note
- SAP Note 1584972 – Directory traversal in FI-CA
- SAP Note 1497003 – Potential directory traversals in applications
Affected components
- IS-PS-CA 471
- IS-PS-CA 472
- IS-PS-CA 600
- IS-PS-CA 602
- IS-PS-CA 603
- IS-PS-CA 604
- IS-PS-CA 605
- IS-PS-CA 606
- IS-PS-CA 616
Full note on SAP: SAP Support Launchpad note 1775317
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
