SAP security note 1509883, "FI-CA Data Transfer – Directory Traversal". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An FI-CA program for data transfer contains a vulnerability through which a malicious user can potentially read or change arbitrary files on the remote server, possibly corrupting data or altering system behavior.
Solution
Please implement the attached correction instruction. Refer to Note 1497003 for additional information and instructions. The corrections from Note 1497003 are a prerequisite for the implementation of this note.
Reason and prerequisites
The programs contained in the correction instructions fail to correctly validate the path which a file that is read or changed from the remote server is referenced. This means that an attacker can potentially read or change data on the remote system.
CVSS
Score 0
References
- Note 1584976 – FS-CD: Potential Directory Traversal
- Note 1497003 – Potential directory traversals in applications
Affected components
- FI-CA versions 600 to 605
Full note on SAP: SAP Support Launchpad note 1509883
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].