Improper Authorization in @sap-cloud-sdk/core
Summary
GHSA-r2vw-jgq9-jqx2: Improper Authorization in @sap-cloud-sdk/core. Affects @sap-cloud-sdk/core versions >= 1.19.0, < 1.21.2. Fixed in 1.21.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @sap-cloud-sdk/core package is an npm package that provides a set of tools and utilities for developing applications with the SAP Cloud SDK. It offers functionalities such as authentication, HTTP requests, and data modeling. This package is widely used by developers to interact with SAP services and build applications on top of the SAP Cloud Platform.
Vulnerability Detail
Affected versions of @sap-cloud-sdk/core have an improper authorization vulnerability. The verifyJwt() function in the package does not properly validate the URL from where the public verification key for the JSON Web Token (JWT) can be downloaded. This means that any URL provided in the JWT can be trusted, allowing an attacker to manipulate the URL and potentially perform unauthorized actions or gain unauthorized access to resources. This vulnerability has a high severity rating (CWE-285) and can lead to serious security breaches if exploited.
How To Fix
Minimum fixed version
1.21.2
This is the first release that contains the fix.
npm install @sap-cloud-sdk/core@1.21.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The @sap-cloud-sdk/core package has an improper authorization vulnerability that can be exploited to perform unauthorized actions or gain unauthorized access to resources. It is crucial for developers to upgrade to the fixed version (1.21.2 or later) to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for @sap-cloud-sdk/core →
FAQ
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including this specific vulnerability in @sap-cloud-sdk/core.
If this vulnerability is exploited, an attacker could manipulate the JWT URL and potentially perform unauthorized actions or gain unauthorized access to resources within the SAP Cloud SDK. This could lead to data breaches, unauthorized data modifications, or unauthorized access to sensitive information.
Currently, there are no known workarounds for this vulnerability. It is recommended to upgrade to the fixed version of the @sap-cloud-sdk/core package to ensure the proper validation of JWT URLs.
Yes, you can find more details about this vulnerability, including the affected versions and fixed version, in the advisory published by the GitHub Security Advisory Database. The advisory can be accessed at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-r2vw-jgq9-jqx2/GHSA-r2vw-jgq9-jqx2.json.
To update your application, you need to modify your package.json file to specify the desired version of the @sap-cloud-sdk/core package. For example, you can set the version to "^1.21.2" to ensure that your application uses version 1.21.2 or later. After updating the package.json file, run the package manager command (e.g., npm install) to fetch the updated package and its dependencies.
References
Related vulnerabilities
Recent vulnerabilities recorded for @sap-cloud-sdk/core.
