# Critical Flaw in SAP’s Python Cloud SDK Exposes Application Credentials to Attackers
## Understanding the Security Vulnerability
A serious security weakness has been discovered in SAP’s Python Cloud SDK, a toolkit used by applications to connect to services on SAP’s business platform. The vulnerability allows an attacker to steal an application’s authentication credentials by manipulating a simple piece of input: the name of a tenant subdomain.
This issue has been assigned the highest possible severity rating, reflecting how easily it can be exploited and how damaging the consequences could be.
## What Exactly Is the Problem?
Applications that run on SAP’s cloud platform often serve multiple customers, or “tenants.” Each tenant has its own subdomain name. When an application needs to communicate with SAP services on behalf of a specific tenant, it passes that subdomain name to the SDK.
The SDK then uses that subdomain to build a web address where it requests an access token — essentially a digital passkey that lets the application act on behalf of the tenant. To get this passkey, the SDK sends the application’s client ID and client secret to the server at that address.
The flaw is that some versions of the SDK accepted any subdomain name without questioning it — including malicious ones. If an attacker could control the subdomain name being passed, they could redirect the credential request to a server they own, silently capturing the application’s secrets.
## Which Versions Are Affected?
The problem first appeared when the SDK was initially released in March. A fix was applied in version 0.45.2, which came out in late August. However, the fix was not applied consistently across all parts of the software.
Here is a simplified breakdown of which versions are safe and which are not:
– **Before version 0.45.2:** All versions are affected. No protection exists.
– **Versions 0.45.2 through 0.52.2:** Safe. The fix is properly applied.
– **Versions 0.53.0 through 0.55.0:** Vulnerable again. A new code path introduced for the Destination service module forgot to include the fix. The Document Management Service module was also affected in version 0.55.0.
– **Version 0.55.1 and later:** Safe. The missing check was restored.
– **Older versions on a legacy line (0.36.x):** These versions never received the fix, even after the August update.
## How the Fix Works
The fix is straightforward but effective. It requires that the tenant subdomain be a clean, simple name made only of letters, numbers, and hyphens, and no longer than 63 characters. If the subdomain contains any unusual characters — such as dots or slashes that could be used to redirect the request to a different server — the SDK immediately rejects it and stops the process with an error message.
## What Should Users Do?
If you are using the SAP Python Cloud SDK, the recommended action is to upgrade to one of the safe versions listed above. If you are stuck on an older version that cannot be updated right now, SAP suggests that your application manually verify the tenant subdomain against a pre-approved list of registered tenants before ever passing it to the SDK.
It is not yet clear whether organizations that may have been running a vulnerable version should also replace their application credentials as a precaution, since the official guidance does not specify this step.
## How Was This Discovered?
The vulnerability was reported by a contributor on GitHub. SAP confirmed the issue and released a fix 53 days after the initial discovery. No known attacks have been documented as a result of this flaw.
—
## Frequently Asked Questions
**Q: What type of attack does this vulnerability enable?**
A: This is classified as a server-side request forgery, meaning an attacker can trick a server into sending sensitive data to a location they control. In this case, the sensitive data is the application’s client credentials.
**Q: Can this vulnerability be exploited remotely?**
A: Yes, but with a condition. The attacker must be able to influence the tenant subdomain value that the application passes to the SDK. This makes it exploitable in multi-tenant setups where user input or configuration determines the subdomain.
**Q: Does this vulnerability affect all SAP cloud services?**
A: No. It specifically affects applications that use the Python SDK to connect to Agent Gateway, Destination, and Document Management Service modules on SAP Business Technology Platform.
**Q: Is there an easy way to check which version I am running?**
A: Yes. You can check the installed version of the SDK using standard Python package management tools. Comparing that version against the safe and affected ranges above will tell you if you are at risk.
**Q: Was this vulnerability exploited in the wild?**
A: As of the disclosure, there have been no reported attacks or incidents tied to this flaw.
—
## Conclusion
This vulnerability highlights how even a small oversight in input validation can expose sensitive application credentials to malicious actors. The fact that the fix was partially undone in later releases due to a code refactor underscores the importance of thorough testing when modifying shared code paths. Organizations using SAP’s Python Cloud SDK should prioritize upgrading to a patched version and review their tenant subdomain handling as part of a broader security audit.
Thank you for reading
