CVE-2023-50423

SAP BTP Security Services Integration Library (sap-xssec) < 4.1.0 – Privilege escalation vulnerability

• CVSS 9.8
• CWE-749
• Authentication, Authorization, and Session Management
• Remote

SAP BTP Security Services Integration Library ([Python] sap-xssec) – versions < 4.1.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.

CVE

CVE-2023-50423

CWE

CWE-749

CVSS base score

9.8

Published

2023-12-12

OWASP

A01 Broken Access Control

Orthogonal defect classification

Checking

Code defect classification

Missing Check

Category

Authentication, Authorization, and Session Management

Subcategory

Privilege Escalation

Accessibility scope

Remote

Impact

Privilege Escalation

Fixed by upgrading

Yes

Solution

Update SAP BTP Security Services Integration Library ([Python] sap-xssec) to version 4.1.0 or higher

from sap_xssec import SecurityContext

class ModifiedSecurityContext(SecurityContext):
    def __init__(self, token):
        super().__init__(token)

context = ModifiedSecurityContext("user_provided_token")

from sap_xssec import SecurityContext

class ModifiedSecurityContext(SecurityContext):
    def __init__(self, token):
        super().__init__(token)
        self.validate_token(token)

    def validate_token(self, token):
        if not self.is_token_valid(token):
            raise ValueError("Invalid token: Unauthorized access")

    def is_token_valid(self, token):
        valid_tokens = ["valid_token_1", "valid_token_2"]
        return token in valid_tokens

try:
    context = ModifiedSecurityContext("user_provided_token")
except ValueError as e:
    print(e)

@misc{vaitp:cve202350423,
  title        = {{SAP BTP Security Services Integration Library (sap-xssec) < 4.1.0 - Privilege escalation vulnerability}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2023},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2023-50423},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-50423/}}
}