
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
abap_cloud_platform
Advanced tools
The minimum cloud foundry/SAP cloud platform APIs required to access an APAP repository. Might be useful for other cloud foundry services
Get the authentication token
const CFENDPOINT = "https://api.cf.eu10.hana.ondemand.com" // EU cloud trial
// get the login URL
const info = await cfInfo(CFENDPOINT)
const loginUrl = info.links.login.href
// get logon token
const pwdGrant = await cfPasswordGrant(loginUrl, "username", "password")
const token = pwdGrant.accessToken
Use it to get the cf account organizations/spaces/instances/...
// cf Organizations
const organizations = await cfOrganizations(CFENDPOINT, token)
//cf spaces
const spaces = await cfSpaces(CFENDPOINT, organizations[0].entity, token)
// cf Service instances
const instances = await cfServiceInstances(CFENDPOINT, spaces[0].entity, token)
// cf Services
const services = await cfServices(CFENDPOINT, token)
...nad then get the ABAP service key
// now I want the ABAP service key, so let's find the right service instance
const findAbapTag = (tags: string[]) => tags && tags.find(t => t === "abapcp")
const abapService = services.find(s => findAbapTag(s.entity.tags))
const abapServiceInstance = instances.find(
i => i.entity.service_guid === abapService?.metadata.guid
)
// list of all keys
const abapServiceKeys = await cfInstanceServiceKeys(
CFENDPOINT,
abapServiceInstance.entity,
token
)
// a single key named SAP_ADT, usually used by Exlipse
const abapServiceKey = await cfInstanceServiceKey(
CFENDPOINT,
abapServiceInstance.entity,
"SAP_ADT",
token
)
Finally ask the user to login (on his browser) and get some ABAP code
const { url, clientid, clientsecret } = abapServiceKey.entity.credentials.uaa
// code token This will open a browser window where the user can login.
// Beware: no timeout
const codeGrant = await cfCodeGrant(url, clientid, clientsecret, loginServer())
const headers = {
Authorization: `bearer ${codeGrant.accessToken}`,
Accept: "text/plain"
}
const resp = await got(
`${key.credentials.url}/sap/bc/adt/oo/classes/cx_root/source/main`,
{ headers }
)
Get system details based on the given token
const user = await getAbapUserInfo(key.credentials.url, codeGrant.accessToken)
console.log(user.UNAME)
const info = await getAbapSystemInfo(key.credentials.url, codeGrant.accessToken)
console.log(info.SYSID)
FAQs
A handful of cloud foundry API methods
The npm package abap_cloud_platform receives a total of 2 weekly downloads. As such, abap_cloud_platform popularity was classified as not popular.
We found that abap_cloud_platform demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.