SAP BTP Destinations

In SAP BTP, destinations are configuration objects that define how an application reaches a remote system: target URL, authentication method, proxy type, and additional properties. They are the connectivity layer that bridges BTP apps to backends - SAP and non-SAP, cloud and on-premise - and they are the single most valuable thing to enumerate early on a BTP engagement, because a destination often stores both the route to a sensitive backend and the credential to use it.

This page is the background and enumeration reference: what a destination is, where it lives, and how to inventory them. The concrete abuse chains - cleartext credential disclosure via the REST API, SSRF, OAuth2SAMLBearer abuse, on-prem pivot - live on Destination Service Abuse. SOAP-specific exposure lives on Exposed SOAP Services.

Anatomy of a destination:

The two fields that most shape the attack surface: . Proxy Type tells you whether this destination reaches into the customer’s on-prem network (OnPremise -> Cloud Connector)

• Authentication tells you whether a reusable static secret is sitting inside it (BasicAuthentication / OAuth2Password / OAuth2ClientCredentials store one; principal propagation and SAMLBearer do not).

A misconfigured or over-permissive destination exposes the backend behind it.

• Stored technical-user credentials (Basic / OAuth password / client-secret) are retrievable in cleartext by any principal with destination-read scope - see Destination Service Abuse.
• OnPremise destinations bridge into internal systems (S/4HANA, SuccessFactors, custom backends) through Cloud Connector - a cloud-to-on-prem pivot.
• NoAuthentication destinations grant whoever can invoke them the backend’s access with no credential at all.
• Non-HTTPS destinations expose traffic to interception.
• OAuth2 flows on a destination can be abused to impersonate users.

Where destinations are defined and consumed (each is an enumeration surface):

• Goto BTP Cockpit -> Connectivity -> Destinations (subaccount level), and per service instance
• VCAP_SERVICES - a bound Destination-service instance injects credentials into the app container (harvest via Cloud Foundry Container Access)
• Destination-service REST API - OAuth2 client-credentials flow (the abuse path)
• btp / cf CLI, Business Application Studio (CAP/UI5 consumption), Kyma (kubectl, destination CRs), Integration Suite adapters

Inventory via the REST API (metadata only - the credential-returning find call is on the abuse page):

# Subaccount-level destinations (names, types, proxy types, auth types - no secrets):
GET https://<destination-service-host>/destination-configuration/v1/subaccountDestinations
Authorization: Bearer <destination-service-token>

Token acquisition is a client_credentials mint from a Destination-service service key - see Service Key Abuse.

Triage the inventory - flag, in priority order:

1. proxyType: OnPremise -> on-prem pivot candidate (which backend? which Cloud Connector?)
2. authentication: NoAuthentication -> invoke-and-reach with no credential
3. BasicAuthentication / OAuth2Password / OAuth2ClientCredentials -> static secret retrievable in cleartext
4. Non-https URLs -> potential MITM candidate
5. Destinations naming a high-privilege technical user

• Enforce least privilege on destination authentication - technical users with minimal backend roles, never a broad service account.
• Prefer OAuth2SAMLBearerAssertion / Principal Propagation (X.509 mTLS) over stored BasicAuthentication - these never expose a reusable static secret.
• Always use HTTPS endpoints; never plain HTTP.
• Restrict and scope Cloud Connector access to prevent lateral movement from OnPremise destinations.
• Apply RBAC to who can create, read, or modify destinations; treat destination_configuration.ApiAccess-class scope as Tier-0.
• Audit destination definitions regularly for exposed credentials, non-HTTPS targets, and unused entries.

• Destination-service audit log for creation/modification events and for bursts of find calls (credential-harvesting signature - detail on Destination Service Abuse).
• Alert on any new grant of ApiAccess/AccessClientSecrets-class scope.
• Subject to BTP Audit Log coverage limits - see BTP Audit Log Blind Spots.

• SAP Help Portal – Destinations in SAP BTP
• SAP Help – Calling the Destination Service REST API
• SAP Cloud Connector Security Considerations
• Destination Service Abuse
• Exposed SOAP Services
• Service Key Abuse