SAP security note 2109565, "Potential information disclosure relating to IMPORT FROM statement in SAP HANA", is a note. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An user or attacker can discover information from files on the HANA server.
Solution
As of SAP HANA SPS 08 database revision 85, you can manage a restriction for the local and/or shared file accesses using two INI configuration parameters, named CSV import path filter.
Enable CSV Import Path Filter via HANA Administration Console: in indexserver.ini, section import_export, set key enable_csv_import_path_filter to true. This is set to true by default starting with HANA SPS 09. This reconfigures IMPORT FROM so that it is only accessible to CSV files stored under the specified directory paths; the following three paths are accepted by default: $DIR_INSTANCE/work, $DIR_INSTANCE/backup, $SAP_RETRIEVAL_PATH/trace.
Optionally, specify additional file paths: in indexserver.ini, section import_export, set key csv_import_path_filter to one or more absolute directory paths separated by a semicolon to allow additional directories.
Reason and prerequisites
Files on the HANA server's file system can be accessed by authenticated users. Users need the IMPORT privilege to access files on the file server, which is not granted by default to any user. The access is limited to files which can be read by the <sid>adm of the HANA system.
The file system path to access files on the server cannot be further restricted within HANA before revision 85.
CVSS
Score 3.5 Vector: AV:N/AC:M/Au:S/C:P/I:N/A:N
References
Affected components
- HDB 1.00
Full note on SAP: SAP Support Launchpad note 2109565
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
