SAP security note 1953939, “Directory Traversal Vulnerability in /CEECV/ROFI_D205_MERGE_XML”. Below are the symptom and SAP recommended solution.
Description
Symptom
The endpoint /CEECV/ROFI_D205_MERGE_XML contains a vulnerability that allows an attacker to perform directory traversal. This can enable unauthorized writing of arbitrary files to the remote server, potentially leading to data corruption or alteration of system behavior.
Solution
SAP recommends applying the latest Support Package to address this issue. If an immediate solution is required, follow these steps using the Note Assistant:
- Apply Manual Corrections: download and apply the manual corrections provided in the attachment Guide – Logical File Path, Name (ROFI).docx.
- Apply Code Corrections: use transaction SNOTE to apply the code correction instructions from the note. Ensure that you have applied the prerequisites from Note 1497003 before implementing this note.
- Set Up Logical File Names: a new logical file name /CEECV/ROFI has been created for validating physical file names. To enhance security and reduce the number of logical file names, create a directory structure that reflects user and program names, securely separating data created by different users and programs.
Reason and prerequisites
The vulnerability arises because /CEECV/ROFI_D205_MERGE_XML does not properly validate the path to which a user-submitted file is written. Consequently, an attacker can overwrite data on the remote system.
Full note on SAP: SAP Support Launchpad note 1953939
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].