Description

SAP Approuter does not correctly validate client certificates in certain callback flows. An attacker with low privileges, holding a certificate from the same trusted authority with matching subject values, could bypass the identity check. This complexity makes the attack difficult to execute. Successful exploitation could allow impersonation of a trusted internal component, resulting in a high impact on integrity and a low impact on confidentiality and availability.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-08-11T01:17:22.757Z",
  "pubdate": "2026-08-11T01:17:22.757Z",
  "executiveSummary": "This vulnerability involves an improper client certificate validation flaw within specific callback flows of SAP Approuter. The security defect enables a low-privileged attacker who possesses a valid certificate issued by the same trusted Certificate Authority, and whose certificate shares matching subject values, to successfully bypass critical identity verification checks. Successful exploitation of this vulnerability results in the unauthorized impersonation of a trusted internal architectural component, yielding a high impact on system integrity while presenting a low impact on confidentiality and availability. The overall attack complexity is considered high, demanding specific attacker positioning and prerequisite possession of a properly scoped cryptographic certificate from a shared trust anchor. The associated risk stems from the potential degradation of trust boundaries within microservices or internal backend communications routed through the affected SAP Approuter deployment, allowing malicious actors to spoof internal communications and subvert expected security policies.",
  "technicalDetails": "The root cause of the vulnerability resides in the cryptographic identity verification logic implemented within specific callback flows of the SAP Approuter component. During mutual TLS or upstream certificate forwarding scenarios, SAP Approuter fails to comprehensively validate all required distinguishing attributes or constraints of presented client certificates, relying instead on insufficient validation parameters such as matching subject values and trust path validation against a shared trusted authority.\nTo execute an attack, the adversary must operate with low privileges and acquire a legitimate X.509 certificate issued by the identical trusted Certificate Authority that authenticates legitimate internal components. This certificate must be successfully populated with subject values that align with those expected by the application or service during the vulnerable callback flow.\nThe step-by-step attack flow proceeds as follows: First, the low-privileged attacker establishes a connection to the vulnerable SAP Approuter instance or initiates the targeted callback sequence. Second, the attacker presents their acquired client certificate, which chains to the mutually trusted authority and contains the matching subject values required by the validation routine. Third, due to the inadequate validation checks in the callback flow, SAP Approuter incorrectly evaluates the presented certificate as belonging to a legitimate, highly privileged internal component rather than the low-privileged user's session. Fourth, the identity check is bypassed, granting the attacker unauthorized authorization context equivalent to the spoofed trusted internal component.\nThe vulnerable component is the SAP Approuter application, specifically within the routines handling client certificate validation during designated callback flows. Network exposure typically involves internal or external endpoints exposed via the Approuter reverse proxy architecture where client certificate authentication or propagation is enabled. The post-exploitation impact is characterized by a high compromise of data and system integrity, as the attacker can inject, modify, or execute operations downstream under the guise of an authenticated internal system, despite the confidentiality and availability of the underlying systems remaining largely unaffected."
}