DEV Community

Anoymask
Anoymask

Posted on

SAP Cloud SDK for Python CVE-2026-89111: OAuth2 Client Credentials Exfiltration via tenant_subdomain

#security #threatintel

1. Basic Information

2. Overview

In multi-tenant BTP applications, if an attacker controls the tenant_subdomain, the SDK embeds that value into the OAuth2 token request URL, resulting in an SSRF flaw that sends the client ID and secret to an attacker-controlled server.

3. Attack Flow

The following attack and exploitation paths are identified from public information. We distinguish between observed facts, reproduced experiments, and feasibility.

OAuth2 Credential Exfiltration via tenant_subdomain

  1. An attacker passes an attacker-controlled value to the tenant_subdomain parameter via requests to a multi-tenant application.
  2. The vulnerable SDK embeds the value into the OAuth2 token URL without sufficient validation.
  3. The application sends the OAuth2 token request to the attacker-controlled server instead of the legitimate token endpoint.
  4. The client ID and client secret included in the request are sent to the attacker.
  5. The attacker attempts to obtain legitimate OAuth2 tokens or access BTP resources based on the scope and validity of the credentials.

4. Attacker Position and Execution Location

  • A remote unauthenticated attacker capable of passing tenant_subdomain to the application. The specific input vector depends on the implementation of each consumer application.

5. Visibility for Victims and Administrators

  • Users: Appears as a normal application error or tenant resolution failure; client credential transmission may not appear in the user interface.
  • Administrators: Appears as an OAuth2 POST to an unusual hostname, DNS query, TLS connection, token error, or abnormal use of the same client ID.

6. Success and Failure Conditions

Success Conditions

  • Using a multi-tenant BTP application with sap-cloud-sdk prior to 0.45.2.
  • An attacker can control tenant_subdomain via external input.
  • DNS and network egress from the application to the attacker's server are permitted, and credentials are included in the token request.

Failure Conditions and Countermeasures

  • Update sap-cloud-sdk to version 0.45.2 or later.
  • Validate tenant_subdomain against both an allowlist of registered tenants and RFC 1123 DNS label rules.
  • Implement an egress allowlist for the OAuth2 token endpoint and perform secret rotation.

7. Impact of Successful Exploitation

  • External transmission of OAuth2 client ID and client secret.
  • Potential token acquisition and API access as a legitimate application identity.
  • Modification of SAP BTP data and services or information theft within the credential scope.

8. Observable Logs

The following items are candidates for investigation within your organization. We distinguish between facts observed in public information and telemetry to be verified internally.

  • Email: No email vectors specific to this issue have been identified.
  • Proxy / SWG / DNS: Check for token POSTs to destinations other than legitimate SAP/BTP domains, hostnames derived from tenant_subdomain, DNS lookups, and TLS SNI.
  • Endpoint / EDR: Check outbound connections of the application process, dependency versions, error stacks, and environment/secret access.
  • Identity / IdP: Check client credential grants, unusual IPs, regions, and UAs for the same client ID, token audience/scope, and successes following failures.
  • SaaS / Cloud: Check SAP BTP audit logs, destinations/bindings, service instances, OAuth clients, role collections, and API access.
  • Network: Check POST requests sent from the application subnet to unauthorized domains on TCP/443, and subsequent access from external IPs to SAP endpoints.

9. Determining Attack Success

Confirmed in Public Information

SAP states that SSRF allows external transmission of OAuth2 client credentials. The reviewed advisory contains no mention of attack attempts, successful credential theft, or PoCs.

Internal Determination Criteria

  • Criteria: Confirm evidence that OAuth2 client credentials were actually sent to an attacker-controlled destination. Do not assume credential theft based on outbound traffic alone; independently confirm successful authentication following the theft.
  • Correlate requests, responses, processes, authentication, data access, and external transmission chronologically to separate contact from success.
  • Do not conclude success based solely on a single alert not present in public information.

10. Investigation Playbook

  • Investigation Origin: Triggered by CVE-2026-89111 detection, unusual token endpoints, tenant resolution errors, or abnormal client secret usage.
  • Initial Checks: Verify dependency versions, tenant_subdomain input paths, URL construction locations, egress policies, and client credential scopes.
  • Endpoint/Server Investigation: Preserve application logs, traces, DNS cache, proxy logs, container images/SBOMs, and secret store access.
  • Identity/Cloud Investigation: Check OAuth2 client grants, issued tokens, scopes, BTP audits, service bindings, and API access from unusual IPs.
  • Subsequent Activity: Track resource listing, data reading, configuration changes, secret additions, and persistence using stolen credentials.
  • Containment: Update to 0.45.2, restrict egress to token endpoints, rotate client secrets, revoke existing tokens, and reduce excessive scopes.
  • Determination Categories: Separate and judge malicious input, SSRF requests, credential transmission, token acquisition, API access, and data/configuration changes.

11. Defense and Detection Ideas

  • Single Event: Detect OAuth2 token requests directed to destinations other than approved SAP domains, or inputs where tenant_subdomain contains dots, slashes, schemes, or ports.
  • Time-Series Correlation: Correlate abnormal tenant_subdomain -> external DNS/POST -> client credential grant -> unusual BTP API access.
  • Threat Hunting: Search application egress for unauthorized destinations to /token paths, sudden changes in IP/region for the same client ID, and artifacts using versions prior to 0.45.2.
  • Log Limitations: If the application masks request body contents, credential transmission details cannot be confirmed, requiring supplementation with destination and identity telemetry.
  • Priority Actions: Prioritize SDK updates, tenant allowlists, token endpoint egress allowlists, short-lived secrets, least privilege, and secret rotation.

12. Facts / Inference / Hypothesis

Facts

  • SAP Cloud SDK for Python versions prior to 0.45.2 embed tenant_subdomain into OAuth2 token request URLs without safe validation in multi-tenant BTP applications.
  • If an attacker controls the tenant_subdomain parameter, token requests are redirected to an attacker-controlled server, causing client credentials to be exfiltrated externally.
  • The GitHub Security Advisory rates CVSS 3.1 as 10.0, evaluating it as network, low complexity, no privileges, no user interaction, and scope changed.
  • Version 0.45.2 validates tenant_subdomain using RFC 1123 DNS label rules before inserting it into the token URL.
  • If updating is not possible, a workaround is provided for consumer applications to validate an allowlist of registered tenant subdomains.
  • Public information contains no records of active exploitation for CVE-2026-89111.

Inference

  • If the privileges of the stolen client credentials are broad, attackers may obtain tokens as a legitimate application and access BTP services or connected APIs.
  • It is necessary to monitor not only SSRF requests but also client credential transmission to unusual token endpoints and subsequent legitimate OAuth2 usage simultaneously.

Hypothesis

No additional hypotheses. Unverified items are listed in "14. Unresolved Items and Additional Investigation".

13. MITRE ATT&CK Mapping

ID Technique Confidence Basis
T1190 Exploit Public-Facing Application high An attacker-controlled tenant_subdomain is passed to the application to redirect the SDK's token request externally.
T1078.004 Valid Accounts: Cloud Accounts medium Stolen credentials can be used as a legitimate cloud application identity depending on their scope.

14. Unresolved Items and Additional Investigation

  • Typical frameworks and deployment patterns where tenant_subdomain is exposed to external inputs.
  • The number of affected BTP applications and credential scopes.
  • Observation status of active exploitation, scanning, and attack domains.

15. Impact on SOCs and Organizations

Organizations using SAP BTP / Cloud SDK should check their dependency inventories and lock files to verify sap-cloud-sdk versions and update to 0.45.2. Token endpoint hostnames should be allowlisted, client secret usage history and POSTs to unusual domains should be retrospectively investigated, and credentials must be rotated if exposure is possible.

16. Summary by Role

  • SOC Teams: Correlate tenant_subdomain inputs -> unusual token endpoints -> client credential transmission -> abnormal token usage for the same client ID.
  • Administrators: Update sap-cloud-sdk to 0.45.2, implement registered tenant allowlists, restrict egress, and execute client secret rotation.
  • Users: No user action is required. Follow any guidance such as re-authentication provided by your SAP application administrator.

Top comments (0)