## https://sploitus.com/exploit?id=E10C0347-A487-529C-A636-E98E109449EE
# CVE-2026-58231 Detection Script
Detection and precondition-verification tool for **CVE-2026-58231** — improper authorization in the Data Hub Adapter component of SAP Commerce Cloud (CVSS 10.0).
The script performs non-destructive checks only. It does not ship or execute any code-injection payload.
## Background
CVE-2026-58231 allows an unauthenticated remote attacker to abuse a default authentication client and submit crafted input to insufficiently validated functions of the Data Hub Adapter, potentially resulting in arbitrary code execution.
| Field | Value |
|---|---|
| Product | SAP Commerce Cloud — Data Hub Adapter |
| Affected branches | COM_CLOUD 2211, COM_CLOUD 2211-JDK21 |
| Fixed releases | 2211.55, 2211-jdk21.17 |
| CWE | CWE-94 (Code Injection) |
| CVSS 3.1 | 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) |
| Vendor advisory | SAP Security Note [3771065](https://me.sap.com/notes/3771065) |
## Checks Performed
1. **Commerce fingerprinting** — identifies SAP Commerce Cloud surfaces (`/hac/`, `/backoffice/`, Spring OAuth authorization server).
2. **Adapter exposure** — probes `/datahubadapter/*` paths to determine whether the import interface is reachable.
3. **Default authentication client** — tests whether the legacy default OAuth client still authenticates at the authorization server. This is the documented exploitation precondition of CVE-2026-58231.
4. **Authorization boundary diff** — compares the import endpoint response with an anonymous request versus a valid default-client token, distinguishing enforced vs non-enforced authorization.
## Verdicts
| Verdict | Meaning |
|---|---|
| `PASS` | Check negative — control present / surface absent |
| `INFO` | Neutral fingerprint information |
| `WARN` | Adapter surface exposed, behavior inconclusive |
| `HIGH` | Default-client token accepted where anonymous is rejected |
| `CRIT` | Documented exploitation preconditions met |
Verdicts are deliberately conservative: a positive result confirms preconditions described in the advisory, not full compromise. Confirming end-to-end impact requires the vendor patch-diff workflow (SAP Note 3771065, compare `datahubadapter` 2211.54 vs 2211.55).
## Requirements
```
pip install requests
```
Python 3.8+
## Usage
```
python3 cve-2026-58231-detect.py https://target.example --i-am-authorized
python3 cve-2026-58231-detect.py https://target.example --i-am-authorized --timeout 15 --delay 0.8
python3 cve-2026-58231-detect.py https://target.example --i-am-authorized --json findings.json
```
### Options
| Flag | Description |
|---|---|
| `--i-am-authorized` | Required. Confirms lawful authorization to test the target. |
| `--timeout` | Per-request timeout in seconds (default: 10). |
| `--delay` | Delay between requests in seconds (default: 0.4). |
| `--json` | Write structured results to a file. |
## Example Output
```
[ INFO] Version headers: {"Server": "sap-commerce"}
[ OK] Commerce fingerprint: no strong SAP Commerce indicators
[ PASS] Exposure: all /datahubadapter/* paths 404
[ PASS] Default auth client: 'datahub' rejected (401)
[ PASS] Auth boundary: import endpoint 404, skipped
Target : https://target.example
Verdict : INFO
Reference: SAP Note 3771065 | fixed in 2211.55 / 2211-jdk21.17
```
## Remediation Reference
- Apply SAP Security Note 3771065 and redeploy on 2211.55 / 2211-jdk21.17 or later.
- Until patched, restrict `/datahubadapter/import/**` to trusted Data Hub addresses via IP Filter Set.
- Review access logs for unauthenticated requests to the import endpoint.
## Disclaimer
This tool is provided for **authorized security testing and lawful vulnerability management purposes only**.
By using this software you represent and warrant that:
- You own the systems being tested, **or** you hold explicit written authorization (engagement letter, rules of engagement, or bug bounty scope) permitting testing against the target.
- Your use complies with all applicable local, national, and international laws, including but not limited to computer fraud and abuse legislation (e.g., UU ITE No. 1/2024, US CISA/CFAA, UK Computer Misuse Act).
- You will not use this tool to access, disrupt, or exfiltrate data from any system without permission.
The script performs non-destructive network requests only. It ships no exploit payload. Nevertheless, unauthorized scanning of third-party infrastructure is illegal regardless of tooling intent.
**No warranty.** This software is distributed under the MIT License "AS IS", without warranty of any kind. The author assumes no liability for damages, legal consequences, or misuse resulting from its use. Users bear full responsibility for their actions.
## References
- [SAP Security Note 3771065](https://me.sap.com/notes/3771065)
- [NVD — CVE-2026-58231](https://nvd.nist.gov/vuln/detail/CVE-2026-58231)
- [GHSA-686g-q5w6-7j38](https://github.com/advisories/GHSA-686g-q5w6-7j38)
- [EUVD-2026-55999](https://euvd.enisa.europa.eu/enisa/EUVD-2026-55999)