Skip links
RedRays - Your SAP Security Solution
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

SAP Security on Udemy

Directory traversal in RA 2.7, SAP security note 1637409

SAP Note 1637409
SAP Security Note
High priority

SAP security note 1637409, “Directory Traversal Vulnerability in RA 2.7”, is a program error note released on March 13, 2012. Below are the symptom, SAP recommended solution and the affected software components.

ComponentIndustry-Specific Component Retail > Returns Authorization (IS-R-RA)
CategoryProgram error
PriorityCorrection with high priority
TypeSAP Security Note
Version1
StatusReleased for Customer
Released onMarch 13, 2012
LanguageEnglish

Description

Symptom

ReturnsAuthorization contains a vulnerability through which an attacker can potentially write arbitrary files to the remote server, possibly corrupting data or altering system behavior.

Solution

This vulnerability has been corrected in RA 2.7. This vulnerability has been corrected in RA 2.6.

Reason and prerequisites

ReturnsAuthorization fails to correctly validate the path to which a user-submitted file is written. As a result, an attacker can potentially overwrite data in the remote system.

Affected components

  • XRETURNS from 260 to 260
  • XRETURNS from 270 to 270

Full note on SAP: SAP Support Launchpad note 1637409

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Directory traversal #ReturnsAuthorization #RA

Explore More