SAP security note 1953940, "Directory traversal in /CEECV/ROFI_RGCBILA0". Below are the symptom, reason and prerequisites, SAP recommended solution and related references.
Description
Symptom
/CEECV/ROFI_RGCBILA0 contains a vulnerability that allows an attacker to:
- Read arbitrary files on the remote server, potentially disclosing confidential information.
- Write arbitrary files to the remote server, potentially corrupting data or altering system behavior.
Solution
SAP recommends installing solutions by applying a Support Package. If an earlier installation is necessary, use the Note Assistant and follow these instructions:
- Apply manual corrections as outlined in the attachment.
- Use transaction SNOTE to apply code correction instructions from this note.
- Refer to Note 1497003 for additional information and prerequisites required for implementing this note.
To securely separate data created by different users and programs, create a directory structure that reflects the user name and/or program name, and use this structure when setting up physical paths and file names for logical file paths.
Reason and prerequisites
/CEECV/ROFI_RGCBILA0 does not correctly validate the file path used for reading or writing files on the remote server. This flaw allows attackers to:
- Direct the program to access arbitrary files, leading to disclosure of their contents.
- Overwrite data in the remote system by manipulating the file path.
References
Full note on SAP: SAP Support Launchpad note 1953940
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
