High priority
SAP security note 1522668, "Security Enhancements for CTC Backend Function", is a note released on 14.12.2010. Below are the symptom and SAP recommended solution.
Description
Symptom
Using CTC templates to install, configure, or update your system may pose a security risk allowing unauthorized reading of content and arbitrary file access on the application server. The corresponding API should be secured appropriately.
Solution
Implement this security note to secure function modules used by the Central Technical Configuration environment.
Reason and prerequisites
Minor ABAP-based functions used by CTC templates contain content that could be exploited maliciously.
References
Full note on SAP: SAP Support Launchpad note 1522668
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
