GHSA-4mv3-jxxm-9cx2: OAuth2 SSRF vulnerability in SAP Cloud SDK for Python
The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenantsubdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated.
This vulnerability was originally fixed in 0.45.2. It was reintroduced in 0.53.0 when the HTTP client was refactored into a shared core module, and the tenant subdomain validation was not carried over to the new location. The validation was restored in 0.55.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SAP Cloud SDK for Pythonto a version that resolves this vulnerability.Fixed in 0.55.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Multi-tenant BTP applications using the SAP Cloud SDK for Python are affected when an attacker can control the tenant_subdomain parameter. The issue was reintroduced in version 0.53.0 and the validation was restored in 0.55.1.
What does an attacker need to exploit the vulnerability?
The attacker needs control over the tenant_subdomain parameter. They can use it to redirect an OAuth2 token request to a server they control, which can expose client credentials.
How can I remediate the issue?
Use a version with the restored tenant subdomain validation, which is present in 0.55.1. The original fix was in 0.45.2, but it was not retained after the HTTP client refactor in 0.53.0.