GHSA-93m8-crj2-v997: Improper verification of JWT signature in IASContextProvider leads to tenant/user identity spoofing ( sap-cloud-sdk (pip))
The SAP Cloud SDK for Python contains an improper cryptographic signature verification vulnerability (CWE-347) in IASContextProvider, the runtime-context provider registered by default via bootstrap(app).IASContextProvider extracted the apptid, sapgtid and useruuid claims from the IAS JWT in the Authorization header using an unverified decoder and wrote them into the request-scoped RuntimeContext without validating the token signature. A remote caller could submit a self-signed JWT naming a victim tenant/user; the forged identity then propagated to every consumer of the runtime context:OTel span attributes (sap.tenancy.tenantid, user.id) via RuntimeContextSpanProcessorlog records via IdentityLogFilteraudit events (tenantid, userinitiatorid) via AuditClienttenant routing via CBCClientThis completes an earlier remediation that fixed the same unverified pattern in StarletteIASTelemetryMiddleware but did not cover IASContextProvider.
Affected Software
Event History
Frequently Asked Questions
Are applications using the standard bootstrap setup affected without explicitly configuring this provider?
Yes. IASContextProvider is registered by default through bootstrap(app), so applications using that setup can be affected.
What does an attacker need to exploit this issue?
A remote caller only needs to submit an Authorization header containing a self-signed IAS JWT with claims for a chosen tenant or user. No privileges or user interaction are required.
Which downstream functions can receive the spoofed identity?
The forged tenant and user claims can propagate to OpenTelemetry span attributes, log records, audit events, and tenant routing through CBCClient.