Description

SAP Fiori Launchpad does not sufficiently validate certain user-controlled input. An unauthenticated attacker could craft a malicious link that, when clicked by an authenticated user, causes the browser to load attacker-controlled content from an external location. This could be used to exfiltrate sensitive information from the victim's session, resulting in a high impact on confidentiality. There is no impact on integrity and availability.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-22T01:16:53.837Z",
  "pubdate": "2026-09-22T01:16:53.837Z",
  "executiveSummary": "The SAP Fiori Launchpad is susceptible to a vulnerability arising from insufficient validation of user-controlled input, which facilitates an Open Redirect condition. This security flaw enables an unauthenticated attacker to craft and distribute a malicious URL containing a target destination controlled by the attacker. When an authenticated user interacts with this link, the application inadvertently redirects the browser session to the external malicious location.\nThe primary risk associated with this vulnerability is the potential for information exfiltration, as the redirection may be leveraged to intercept sensitive session data or facilitate secondary phishing attacks. The impact is categorized as high regarding confidentiality, although integrity and availability remain unaffected. Exploitation does not require prior authentication from the attacker, but it relies on the victim—an authenticated user—executing the malicious link. Organizations utilizing SAP Fiori Launchpad should address this input validation deficiency to prevent unauthorized redirection and protect session integrity.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper sanitization and validation of redirection parameters within the SAP Fiori Launchpad application logic. When the application handles navigation requests, it fails to verify that the destination URL is restricted to trusted, internal domains. This lack of a strict allow-list or domain-validation mechanism allows the injection of arbitrary URLs into the redirect function.\nThe exploitation process follows a specific attack flow: 1. An unauthenticated attacker identifies a URL parameter within the SAP Fiori Launchpad responsible for navigation or redirection. 2. The attacker crafts a malicious link, embedding a URL pointing to an attacker-controlled external server within that parameter. 3. The attacker distributes this link to a targeted user who is currently authenticated within the SAP environment. 4. Upon clicking the link, the user's browser sends a request to the legitimate SAP Fiori instance. 5. The vulnerable component processes the request and, due to inadequate input validation, issues an HTTP redirect command (e.g., a 302 Found response or a client-side navigation event) directing the user's browser to the attacker's server.\nThe payload behavior leverages the user's existing, authenticated session state. Because the browser follows the redirection while maintaining context, the attacker may capture sensitive information leaked through the referrer header, URL parameters, or via scripts executed on the landing page. By masquerading as a legitimate SAP-originated redirect, the attacker increases the likelihood of user trust, facilitating the exfiltration of sensitive session-specific data. This vector is particularly concerning as it effectively bypasses traditional perimeter security by utilizing a trusted application as the delivery vehicle for the malicious redirection. The vulnerability reflects a systemic failure in the application’s handling of untrusted input passed into navigational controllers, highlighting the necessity for robust server-side validation of all redirect destinations against a pre-defined list of acceptable endpoints."
}