SAP security note 1961947, "Directory Traversal Vulnerability in /CCEE/FISIP". Below are the symptom, reason and prerequisites, SAP recommended solution and the affected software components.
Description
Symptom
The /CCEE/FISIP directory contains a vulnerability that permits an attacker to write arbitrary files to the remote server, which may result in data corruption or changes in system behavior.
Solution
SAP recommends applying the solution by installing a Support Package. If an immediate fix is necessary, follow these steps using the Note Assistant:
- Apply Manual Corrections: follow the instructions in the attachment.
- Apply Code Corrections: use transaction SNOTE to apply the code correction instructions from this note.
- Prerequisite: ensure that Note 1497003 is implemented, as it is required before applying this note.
A logical file name /CCEE/SIFI has been created for validating physical file names. To enhance security and reduce the number of logical file names, create a directory structure that reflects user or program names. This approach helps in securely separating data created by different users and programs.
Reason and prerequisites
The issue arises because /CCEE/FISIP does not properly validate the file path for user-submitted files. Consequently, an attacker could overwrite existing data on the remote system.
Affected components
- C-CEE 110_600
- C-CEE 110_602
- C-CEE 110_603
- C-CEE 110_604
Full note on SAP: SAP Support Launchpad note 1961947
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].