SAP security note 1527437, "Directory Traversal Vulnerability in Confirmation File Import Report", released on May 10, 2011. Below are the symptom and SAP recommended solution.
Description
Symptom
Unauthorized reading of arbitrary files on the server by exploiting the import confirmation file report.
Solution
To mitigate this vulnerability, import the relevant Support Package for your SAP release. For detailed instructions, refer to Note 1497003.
Reason and prerequisites
The vulnerability arises from improper validation of file paths during the directory traversal in the confirmation file import process. By altering the path, a malicious user can access and view any file's content.
Full note on SAP: SAP Support Launchpad note 1527437
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
