Executive brief
The SAP Cloud SDK Core library is used by development teams to build applications that integrate with SAP cloud services. A flaw in its JWT validation function allows attackers to bypass authentication by providing a manipulated public key URL, potentially granting unauthorized access to protected APIs and data.
Technical details
The vulnerability is an improper authorization issue (CWE-285) in the verifyJwt() function of @sap-cloud-sdk/core versions 1.19.0 through 1.21.1. The function fails to properly validate the URL from which the JWT public verification key is downloaded, trusting any URL provided. This allows an attacker to supply a URL pointing to a manipulated JWT or key, enabling authentication bypass. The vulnerability was introduced in version 1.19.0 and requires network access to an application using the vulnerable library. A patch was released in version 1.21.2.
Affected products
- SAP @sap-cloud-sdk/core 1.19.0 through 1.21.1
Timeline
- 2020-09-03: disclosed
- 2020-09-03: patched: Version 1.21.2 released