Executive brief
SAP xssec is a Node.js library that handles security and authentication for applications built on SAP's Business Technology Platform (BTP). A privilege escalation flaw in versions before 3.6.0 allows unauthenticated attackers to obtain arbitrary permissions within affected applications without proper authorization, potentially leading to complete compromise of application security.
Technical details
The vulnerability is a privilege escalation flaw (CWE-269, CWE-639, CWE-749) in the @sap/xssec authentication library affecting all versions prior to 3.6.0. An unauthenticated attacker can exploit this vulnerability under certain conditions to bypass authorization checks and obtain arbitrary permissions within applications using the library. The attack requires network access to affected applications but does not require user interaction or prior authentication. Successful exploitation allows complete privilege escalation, enabling attackers to access and modify application data and functionality. A patch is available in version 3.6.0.
Affected products
- SAP xssec < 3.6.0
Timeline
- 2023-12-12: disclosed
- 2023-12-12: patched: Fixed in version 3.6.0