SAP security note 1512352, "Directory Traversal in batch input reports in class system", is a program error note released on 16.03.2012. Below are the symptom and the SAP recommended solution.
Description
Symptom
This security note has been updated. For details, see Security Notes 1555924 and 1691201.
An error in the batch input report of the classification contains a vulnerability through which a malicious user can potentially read and write arbitrary files on the remote server, possibly corrupting data or altering system behavior.
Solution
Implement the advance correction detailed in this note.
Refer to Note 1497003: the program changes from this note are also a prerequisite for implementing this security note.
After implementing this SAP Note, also apply the following SAP Notes to your system:
- Report RCCTBI01: SAP Note 1612736
- Report RCCLBI01: SAP Note 1620141
- Report RCCLBI02: SAP Note 1620084
- Report RCCLBI03: SAP Note 1555924 and SAP Note 1667018
- Report RCCLBISC: SAP Note 1667832
- Report RCCLBISH: SAP Note 1668730
- Report RCCLDI01: SAP Note 1668992
- Report RCCTBISC: SAP Note 1669488
Reason and prerequisites
The reports RCCTBI01, RCCTBISC, RCCLDI01, RCCLBI01, RCCLBI02, RCCLBI03, RCCLBISC, and RCCLBISH fail to correctly validate the path a user-submitted file is written to. This means that an attacker can potentially overwrite data on the remote system.
Full note on SAP: SAP Support Launchpad note 1512352
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].