@sap/cds-mtxs npm Library: Potential Credential Disclosure Vulnerability
- Severity
- HIGH
- Affected component
- @sap/cds-mtxs (npm)
- Affected versions
- >= 4.0.1, < 4.0.3 or >= 3.0.1, < 3.9.7 or >= 2.0.2, < 2.7.7 or < 1.18.4
- Patched version
- Not yet available
An early warning has been issued regarding a potential vulnerability in the @sap/cds-mtxs npm library that could allow unauthenticated attackers to obtain sensitive credentials and manipulate tenant data in multitenant CAP applications with extensibility enabled.
What happened
The @sap/cds-mtxs npm library reportedly does not perform sufficient checks on certain functionality used in multitenant CAP applications with extensibility enabled. This could allow an unauthenticated attacker to send specially crafted requests to obtain sensitive credentials. These credentials could then be abused to replace or delete tenant data.
This vulnerability is under investigation and has been assigned the identifier GHSA-955M-RR6M-2F9V. It is currently not confirmed to have been exploited in the wild. The affected versions of @sap/cds-mtxs are >= 4.0.1, < 4.0.3 or >= 3.0.1, < 3.9.7 or >= 2.0.2, < 2.7.7 or < 1.18.4.
What to do about it
- Review your application dependencies to determine if you are using an affected version of @sap/cds-mtxs.
- If you are using an affected version, upgrade to a version that includes the necessary checks to prevent credential disclosure.
- Monitor the primary sources for updates on this vulnerability and any official patches that may be released.
- Consider implementing additional security measures to protect sensitive credentials and tenant data in your applications.
How 0Day would have caught this
@sap/cds-mtxs is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are potentially affected if you are using @sap/cds-mtxs npm library in versions >= 4.0.1, < 4.0.3 or >= 3.0.1, < 3.9.7 or >= 2.0.2, < 2.7.7 or < 1.18.4 in your multitenant CAP applications with extensibility enabled.
What should I do right now?
Review your application dependencies and upgrade to a secure version of @sap/cds-mtxs if you are using an affected version. Monitor the primary sources for updates.
Is there an official fix available?
No official fix has been published yet. Monitor the primary sources for updates on any patches that may be released.