Summary
A critical server-side request forgery vulnerability in the SAP Cloud SDK for Python allows an attacker who controls the tenant_subdomain parameter to redirect OAuth2 token requests to an attacker-controlled server.
Because those requests may include client credentials, successful exploitation could expose secrets and enable unauthorized access to connected services.
A critical server-side request forgery vulnerability in the SAP Cloud SDK for Python allows an attacker who controls the tenant_subdomain parameter to redirect OAuth2 token requests to an attacker-controlled server.
Because those requests may include client credentials, successful exploitation could expose secrets and enable unauthorized access to connected services.
Affected context
The vulnerability affects multi-tenant SAP BTP applications that use the SAP Cloud SDK for Python to construct OAuth2 token endpoints from tenant-controlled subdomain values. It becomes risky when application input can influence the destination of a server-side token request without strict tenant validation, trusted endpoint resolution, or destination allowlisting.
The vulnerability affects multi-tenant SAP BTP applications that use the SAP Cloud SDK for Python to construct OAuth2 token endpoints from tenant-controlled subdomain values. It becomes risky when application input can influence the destination of a server-side token request without strict tenant validation, trusted endpoint resolution, or destination allowlisting.
Exploit preconditions
- Attack surface: A multi-tenant application endpoint or workflow that accepts the
tenant_subdomainparameter - Required access: Ability to supply or influence the tenant subdomain value; authentication requirements depend on the application's exposure and authorization controls
- Trigger point: OAuth2 token acquisition using the attacker-influenced tenant identifier
- Why exploitation is possible: The application may construct the token request destination from untrusted input and send credentials to that destination without sufficiently restricting the permitted host or tenant mapping
- Attack surface: A multi-tenant application endpoint or workflow that accepts the
tenant_subdomainparameter - Required access: Ability to supply or influence the tenant subdomain value; authentication requirements depend on the application's exposure and authorization controls
- Trigger point: OAuth2 token acquisition using the attacker-influenced tenant identifier
- Why exploitation is possible: The application may construct the token request destination from untrusted input and send credentials to that destination without sufficiently restricting the permitted host or tenant mapping
Why this happens
The underlying issue is server-side request forgery caused by using attacker-influenced tenant data to determine an outbound OAuth2 request destination.
When destination construction is based on untrusted input rather than a trusted tenant-to-endpoint mapping, the server can be induced to send authenticated requests to an unintended host. This behavior maps to CWE-918: Server-Side Request Forgery, with the additional risk that OAuth2 client credentials are included in the redirected request.
The underlying issue is server-side request forgery caused by using attacker-influenced tenant data to determine an outbound OAuth2 request destination.
When destination construction is based on untrusted input rather than a trusted tenant-to-endpoint mapping, the server can be induced to send authenticated requests to an unintended host. This behavior maps to CWE-918: Server-Side Request Forgery, with the additional risk that OAuth2 client credentials are included in the redirected request.
Potential impact
- OAuth2 client credentials may be exfiltrated
- An attacker could obtain unauthorized access tokens or impersonate the application
- Connected SAP BTP services and tenant resources could be accessed or modified
- Confidential application data may be disclosed
- The compromised credentials could support lateral movement or broader cloud account abuse
- OAuth2 client credentials may be exfiltrated
- An attacker could obtain unauthorized access tokens or impersonate the application
- Connected SAP BTP services and tenant resources could be accessed or modified
- Confidential application data may be disclosed
- The compromised credentials could support lateral movement or broader cloud account abuse
General mitigation guidance
Mitigation generally focuses on removing attacker control over outbound OAuth2 destinations and reducing the trust placed in tenant-submitted identifiers.
Common defensive patterns include:
- Resolve tenant identifiers through a server-side allowlisted mapping rather than constructing URLs directly from request values
- Permit OAuth2 requests only to validated, approved hosts and schemes
- Use secure-by-default endpoint configuration with fixed trusted authorities where possible
- Validate tenant ownership and authorization independently of subdomain syntax
- Avoid sending client credentials unless the destination has been positively verified
- Apply least-privilege scopes and service permissions to OAuth2 clients
- Treat redirects and user-controlled URL components as untrusted, and disable unnecessary redirect behavior
Mitigation generally focuses on removing attacker control over outbound OAuth2 destinations and reducing the trust placed in tenant-submitted identifiers.
Common defensive patterns include:
- Resolve tenant identifiers through a server-side allowlisted mapping rather than constructing URLs directly from request values
- Permit OAuth2 requests only to validated, approved hosts and schemes
- Use secure-by-default endpoint configuration with fixed trusted authorities where possible
- Validate tenant ownership and authorization independently of subdomain syntax
- Avoid sending client credentials unless the destination has been positively verified
- Apply least-privilege scopes and service permissions to OAuth2 clients
- Treat redirects and user-controlled URL components as untrusted, and disable unnecessary redirect behavior
How teams detect issues like this
Organizations can detect SSRF risks through:
- Static analysis rules identifying outbound HTTP requests whose hosts, URLs, or tenant routing values derive from request parameters
- Code review checks for string-based construction of OAuth2 endpoints
- Tests that supply unexpected tenant values and verify that requests cannot leave approved domains
- Runtime egress monitoring and alerts for token requests to unapproved hosts
- Policy enforcement requiring allowlisted destinations, restricted network egress, and least-privilege OAuth2 scopes
- Automated security review tools that flag untrusted input flowing into network request APIs
Organizations can detect SSRF risks through:
- Static analysis rules identifying outbound HTTP requests whose hosts, URLs, or tenant routing values derive from request parameters
- Code review checks for string-based construction of OAuth2 endpoints
- Tests that supply unexpected tenant values and verify that requests cannot leave approved domains
- Runtime egress monitoring and alerts for token requests to unapproved hosts
- Policy enforcement requiring allowlisted destinations, restricted network egress, and least-privilege OAuth2 scopes
- Automated security review tools that flag untrusted input flowing into network request APIs
Sources
| Source | Link |
|---|---|
| github. | github.com/ |
| url. | url.sap/ |
