Executive brief
The SAP Cloud SDK's destination caching feature can expose sensitive routing and credential information to unauthorized users. When destination caching is enabled and user information is incomplete, the system caches destinations without proper user context, allowing other users to access those cached destinations with their associated permissions. This could lead to privilege escalation or unauthorized data access across multi-tenant applications.
Technical details
This is an improper access control vulnerability (CWE-200) in the @sap-cloud-sdk/core library's destination caching mechanism. When user information is missing during destination lookup, destinations are cached globally without user-specific restrictions. An attacker with network access to the application can exploit this by timing requests to retrieve cached destinations belonging to other users, gaining access to their associated permissions. The vulnerability requires destination caching to be explicitly enabled (disabled by default) and is time-limited by the 5-minute cache TTL. The issue was patched in version 1.52.0 through PRs #1769 and #1770, which enhanced the security of the caching logic.
Affected products
- SAP @sap-cloud-sdk/core < 1.52.0
Timeline
- 2021-11-05: disclosed
- 2021-11-10: patched: Version 1.52.0 released with security fixes