GHSA-r2vw-jgq9-jqx2 Improper Authorization in @sap-cloud-sdk/core
Attackers can bypass authentication by providing a manipulated JWT with a trusted URL for the verification key.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-r2vw-jgq9-jqx2?
GHSA-r2vw-jgq9-jqx2 is an authentication bypass vulnerability in @sap-cloud-sdk/core, published on 3 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Affected versions of @sap-cloud-sdk/core do not properly validate JWTs. The verifyJwt() function does not properly validate the URL from where the public verification key for the JWT can be downloaded. Any URL was trusted which makes it possible to provide a URL belonging to a manipulated JWT.
Recommendation
Upgrade to version 1.21.2 or later.
Which versions are affected by GHSA-r2vw-jgq9-jqx2?
2 open source packages ship an affected version, including @sap-cloud-sdk/core.
| Package | Affected | Fixed in |
|---|---|---|
@sap-cloud-sdk/core npm | From 1.19.0 | 1.21.2 |
@sap-cloud-sdk/core npm | From 1.19.0 | 1.21.2 |
How do I fix GHSA-r2vw-jgq9-jqx2?
Upgrade @sap-cloud-sdk/core to 1.21.2 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is GHSA-r2vw-jgq9-jqx2 being exploited?
There is no known exploitation of GHSA-r2vw-jgq9-jqx2 in the wild and no public exploit code.