AI analysis
SAP Cloud SDK for Python has a critical OAuth2 server-side request forgery flaw (CWE-918) in multi-tenant SAP BTP applications. An unauthenticated remote attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server. That redirection can exfiltrate client credentials and, given the changed scope and high confidentiality and integrity impact, compromise trust beyond the vulnerable component. Applications built with the SDK that accept an attacker-influenced tenant subdomain in the OAuth2 flow are affected; exact versions are not stated in the advisory data. It is not listed in CISA KEV, and no public proof of concept is known.
What to do: Apply the SAP security note or upgrade SAP Cloud SDK for Python as soon as a fixed release is published; do not pass untrusted input as tenant_subdomain. Restrict outbound OAuth2 token requests to known SAP identity endpoints and rotate client credentials if that parameter may have been attacker-controlled.
Affected
| SAP Cloud SDK for Python | — |
Estimated exposure
—No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated.