Directory traversal in INTRASTAT File Creation for Receipt/Dispatch – Estonia Transaction /CEECV/BED, SAP security note 1964201

SAP security note 1964201, "Directory Traversal Vulnerability in INTRASTAT: File Creation for Receipt/Dispatch – Estonia", is a note. Below are the symptom and SAP recommended solution.

Description

Symptom

INTRASTAT: File Creation for Receipt/Dispatch – Estonia contains a vulnerability that allows an attacker to potentially read arbitrary files on the remote server, possibly disclosing confidential information.

Solution

Upgrade to the relevant Support Package by applying the manual corrections provided in this note and the code correction instructions using transaction SNOTE.

Refer to SAP Note 1497003 for additional information and instructions; the corrections from Note 1497003 are a prerequisite for implementing this note.

A logical file name /CEECV/EE has been created to enable the validation of physical file names.

To minimize the number of logical file names, some programs share the same logical name. Ensure secure separation of data by creating a directory structure that reflects user names and/or program names, to help maintain security and reduce dependencies among programs.

Reason and prerequisites

The transaction /CEECV/BED fails to correctly validate the path used to reference a file read from the remote server. This flaw enables an attacker to direct the program to an arbitrary file in the system, leading to unauthorized disclosure of its contents.