SAP Note 1771706
SAP security note 1771706, "Directory traversal in PY-FI". Below are the symptom and SAP recommended solution.
Description
Symptom
SAP Note 1771706 addresses a Directory Traversal vulnerability in the PY-FI component. This vulnerability allows an attacker to write arbitrary files to the remote server, potentially leading to data corruption or altered system behavior.
Solution
To mitigate this vulnerability, follow these steps:
- Implement SAP Note 1497003: ensure that corrections from SAP Note 1497003 are applied, as they are prerequisites for implementing this note.
- Apply the relevant support packages for your software components:
- SAP_HR 46C: SAPKE46CJ5
- SAP_HRCFI 470: SAPK-470E0INSAPHRCFI
- SAP_HRCFI 500: SAPK-500A6INSAPHRCFI
- SAP_HRCFI 600: SAPK-60089INSAPHRCFI
- SAP_HRCFI 604: SAPK-60455INSAPHRCFI
- Configure logical file paths and names using IMG activities or transaction FILE:
- Create the logical file path HR_FI_DIR_DOWNLOAD.
- Assign physical paths to the logical path based on your operating system.
- Define logical file names with appropriate data formats and application areas.
References
Full note on SAP: SAP Support Launchpad note 1771706
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
