Skip to main content
SAP Pentest Playbook
Toggle Dark/Light/Auto mode Toggle Dark/Light/Auto mode Toggle Dark/Light/Auto mode Back to homepage
  2. /
  3. SAP Business Technology Platform
  4. /
  5. Known Attack Vectors
  6. /
  7. XSUAA Token & Authorization Abuse
Edit page

XSUAA Token & Authorization Abuse

Description

XSUAA (Authorization & Trust Management Service) issues and validates the JWTs that authenticate and authorize essentially every SAP BTP application. Each Subaccount gets its own identity zone; tokens carry a jku header pointing at that zone’s /token_keys JWKS endpoint, and scopes are granted to users through Role Collections, which aggregate individual roles built from a role_template_app_id+role_template_name pair - potentially spanning many subscribed applications in one collection (e.g. cis-local!b2 = the platform’s own Subaccount Admin template).

The XSUAA attack surface splits into two genres, each its own page:

  • Library Privilege Escalation (CVE-2023-49583 family) - a patch-level finding: the December 2023 CVSS 9.1–9.8 escalation-of-privileges bug that hit every official SAP BTP Security Services Integration Library simultaneously. Fingerprint the target’s library/buildpack version and diff against the fixed versions.
  • Token Validation & Role-Collection Abuse - design/config attacks that need no library bug: jku/kid trust validation, client-credentials broad authorities, cross-app audience reuse via empty aud, and Role Collection over-assignment.

Risk

A December 2023 CVSS 9.1–9.8 (CWE-749) escalation-of-privileges vulnerability let an unauthenticated attacker obtain arbitrary permissions within any application still on a vulnerable library version. Separately - and independent of that library bug - weak jku/kid trust validation, over-broad Role Collections, and unrotated service-key secrets each allow scope escalation or token forgery. The two pages cover these two paths.

Mitigation

  • Patch every affected layer per SAP Note 3411067 - see the library page.
  • Enforce a jku domain allow-list, apply least privilege to Role Collections, pin an explicit JWT algorithm allow-list, and rotate XSUAA service-key secrets - see the token/role-collection page.

Detection and Monitoring

  • BTP Audit Log Service: Role Collection assignment changes and service-key creation events - see BTP Audit Log Blind Spots for the 90-day default-retention caveat that governs how long this evidence survives.
  • Application-layer logging of JWT validation failures and kid/jku lookups outside the expected domain.
  • CF router/application logs: buildpack-version-revealing or stack-fingerprinting request bursts across many endpoints from one source.

References