SAPwned: SAP AI vulnerabilities expose customers' cloud environments and privat

The Wiz Research Team discovered vulnerabilities in SAP AI Core that could allow malicious actors to compromise the service and access customer data. By exploiting these vulnerabilities, attackers could gain access to customers' private files, cloud credentials, and internal artifacts. The vulnerabilities found in SAP AI Core included issues such as bypassing network restrictions, leaking AWS tokens, exposing user files through unauthenticated EFS shares, compromising internal Docker Registry and Artifactory, and exposing Google access tokens and customer secrets through an unauthenticated Helm server. These vulnerabilities could have led to unauthorized access to sensitive data, manipulation of AI models, and potential supply-chain attacks. The research highlights the importance of improving isolation and sandboxing standards in AI infrastructure to prevent such security breaches. All vulnerabilities were reported to SAP and have been fixed. No customer data was compromised during the research.