Executive brief
SAP Approuter is a Node.js package used to route requests and manage authentication in SAP cloud applications. An attacker can bypass authentication and hijack user sessions by injecting malicious payloads during the authorization code exchange process, leading to unauthorized access to sensitive application data and functionality.
Technical details
The vulnerability is a CWE-601 (Open Redirect/URL Redirection to Untrusted Site) authentication bypass affecting @sap/approuter versions 2.6.1 through 16.7.1. During the OAuth authorization code exchange, an attacker can inject malicious payloads to steal victim session tokens and bypass authentication controls. The attack requires user interaction (victim must complete the OAuth flow), but no authentication is required on the attacker's part. The vulnerability allows high-impact compromise of confidentiality and integrity. A patch is available in version 16.7.2 and later.
Affected products
- SAP Approuter 2.6.1 through 16.7.1
Timeline
- 2025-02-11: disclosed
- 2025-02-11: patched: Fixed in version 16.7.2