XSUAA Library Privilege Escalation (CVE-2023-49583 family)

Updated on Sep 18, 2026

Description

In December 2023, a single CWE-749 (“Exposed Dangerous Method or Function”) escalation-of-privileges flaw hit every official SAP BTP Security Services Integration Library simultaneously, across all four supported languages, plus the frameworks and buildpacks that bundle them. It is a patch-level finding: the entire technique is fingerprinting the target’s library/buildpack version and diffing against the fixed versions. See the XSUAA overview for context and the sibling token/role-collection page for the config-level attacks that need no library bug.

Risk

On a vulnerable version, an unauthenticated attacker can obtain arbitrary permissions within the affected application (CVSS 9.1 per SAP, 9.8 per NVD). Because the bug lives in shared libraries and buildpacks, the vulnerable layer is often not the app’s own direct dependency - a hit on any layer of the stack is a full-privilege-escalation candidate.

Options

CVE-2023-49583 / CVE-2023-50422 / CVE-2023-50423 / CVE-2023-50424 - version matrix:

Language	Package	Vulnerable	Fixed
Node.js	`@sap/xssec`	< 3.6.0	≥ 3.6.0
Java	`com.sap.cloud.security` (java-security / spring-security / spring-xsuaa)	< 2.17.0, and 3.0.0–3.2.x	≥ 2.17.0 / ≥ 3.3.0
Python	`sap-xssec`	< 4.1.0	≥ 4.1.0
Go	`cloud-security-client-go`	< 0.17.0	≥ 0.17.0

The blast radius extends to the frameworks/buildpacks bundling these libraries: CAP Java V1 < 1.34.8, CAP Java V2 < 2.4.1, SAP Java Buildpack < 1.81.1, SAP Cloud SDK for Java < 4.28.0/5.0.0, SAP Cloud SDK for Node.js < 3.9.0, Application Router < 14.4.3, and SAP Edge Integration Cell ≤ 8.9.12 (fixed 8.9.13).

Fingerprint the target’s stack and diff against the fixed versions above - a hit on any layer, not just the app’s own direct dependency, is a candidate:

buildpack banner in cf app <name>
X-Powered-By and other response headers
package.json/pom.xml leakage
error stack traces revealing library/framework versions

Mitigation

Patch every affected layer per SAP Note 3411067 - the library, the buildpack, and the CAP-runtime/App-Router copy, not just the app’s direct dependency.

Detection and Monitoring

CF router/application logs: buildpack-version-revealing or stack-fingerprinting request bursts across many endpoints from one source.
Application-layer logging of authorization decisions that grant scopes inconsistent with the authenticated principal.