SAP Integration Suite (Cloud Integration / CPI)

SAP Integration Suite - specifically its Cloud Integration (CPI, formerly HCI) capability - is a hosted integration platform on BTP where iFlow designers build message-processing pipelines. It is its own product surface with its own authorization model (AuthGroup.IntegrationDeveloper and itemized design/deploy roles), distinct from the runtime and identity layers, and it is unusually dangerous because a single deployable primitive - the Groovy Script step - grants tenant-wide secret disclosure, OS command execution, and an on-prem pivot, all against a permissive, no-CVE-required authorization model.

Pages in this section:

• Groovy Script Step Attack Surface - initial-access primitives: sandbox reality, Secure Store / Keystore credential dump, unconstrained outbound HTTP, Runtime.exec RCE, SSRF/on-prem pivot via destinations, and the roles that gate the whole surface.
• Persistence - turning a foothold durable: Script Collection backdoors (poisoned shared library), productive-iFlow tampering, /api/v1 rogue deploy, and Cloud Transport Management injection across tenants.

iFlow design/deploy rights are commonly granted to a broad developer population and to CI/CD service users. Because the platform separates who can edit from who can deploy but does not gate what gets deployed, compromising any one such account or service key converts into full-tenant Security Material disclosure, code execution on shared runtime infrastructure, and a lateral-movement primitive into on-prem systems via Cloud-Connector-backed destinations.

• SAP Help Portal - Tasks and Permissions for Cloud Integration
• Groovy Script Step Attack Surface
• Persistence
• Build & Deploy Pipeline Tampering
• Service Key Abuse