CVE-2024-22125: SAP GUI Connector Information Disclosure

CVE-2024-22125 Overview

CVE-2024-22125 affects the SAP GUI connector browser extension for Microsoft Edge version 1.0. Under certain conditions, the extension exposes highly sensitive information that should otherwise remain restricted. The flaw is classified under [CWE-497] (Exposure of Sensitive System Information to an Unauthorized Control Sphere).

The vulnerability is exploitable over the network without authentication or user interaction, producing a high impact on confidentiality. Integrity and availability are unaffected. SAP addressed the issue through SAP Security Note #3386378.

Critical Impact
An unauthenticated remote attacker can access sensitive SAP session and configuration data exposed by the Edge connector extension, enabling reconnaissance against backend SAP systems.

Affected Products

SAP GUI Connector for Microsoft Edge, version 1.0
Microsoft Edge browser deployments using the SAP GUI connector extension
SAP environments relying on the Edge-based GUI connector for backend access

Discovery Timeline

2024-01-09 - CVE-2024-22125 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-22125

Vulnerability Analysis

The SAP GUI connector for Microsoft Edge is a browser extension that bridges Edge sessions with SAP GUI backend functionality. Version 1.0 of the extension exposes sensitive information under specific operating conditions, mapped to [CWE-497].

An attacker reaching the affected component over the network can retrieve restricted data without supplying credentials. The information disclosed is sufficient to support further targeting of SAP application servers and connected business processes. No user interaction is required to trigger the disclosure, and the scope remains unchanged within the affected extension.

With an EPSS probability of 0.519% (40th percentile), public exploitation telemetry remains low. The vulnerability is not listed in the CISA KEV catalog, and no public proof-of-concept code is referenced in the advisory.

Root Cause

The root cause is improper restriction of access to system information surfaced by the extension. Internal data structures or runtime state that should remain confined to the extension's trust boundary are reachable through an exposed interface. SAP has not published low-level technical details beyond the references in SAP Note #3386378.

Attack Vector

Exploitation occurs over the network against the browser extension's exposed surface. Because no authentication or user interaction is required, an attacker who can interact with the affected endpoint can request the exposed data directly. The disclosed content may include session identifiers, configuration parameters, or other SAP-related metadata useful for follow-on attacks against the SAP landscape.

No verified exploitation code is available. Refer to the SAP Security Note #3386378 for vendor-supplied technical details.

Detection Methods for CVE-2024-22125

Indicators of Compromise

Presence of SAP GUI connector for Microsoft Edge extension version 1.0 on managed endpoints
Unexpected outbound HTTP requests from Edge processes referencing SAP backend hostnames originating from unauthorized client contexts
Browser extension manifests or installation events for the connector deployed outside of approved software baselines

Detection Strategies

Inventory Microsoft Edge browser extensions across the fleet and flag any installation of the SAP GUI connector at version 1.0
Correlate Edge extension activity with SAP authentication logs to identify session reuse or anomalous data access patterns
Hunt for processes spawned by Edge that read SAP configuration files or session caches outside of expected user workflows

Monitoring Recommendations

Enable logging of browser extension installation and update events through Microsoft Edge enterprise policies
Forward endpoint and browser telemetry into a centralized data lake for retrospective hunting against SAP-related artifacts
Monitor SAP application server logs for anomalous connection sources, particularly unauthenticated probes referencing GUI connector endpoints

How to Mitigate CVE-2024-22125

Immediate Actions Required

Apply the fix referenced in SAP Security Note #3386378 to all affected endpoints
Identify and remove SAP GUI connector for Microsoft Edge version 1.0 from systems that cannot be patched immediately
Restrict network access to SAP backends so that only authenticated, authorized clients can reach connector endpoints

Patch Information

SAP published the corrective guidance in SAP Security Note #3386378. Administrators should review the note in the SAP for Me portal and deploy the updated extension version across all Edge installations. Additional vendor context is available in the SAP security patch documentation.

Workarounds

Disable or uninstall the SAP GUI connector for Microsoft Edge extension until the patched version is deployed
Enforce Edge group policies that block installation of unapproved extensions and restrict the connector to managed configurations
Segment SAP front-end client networks from untrusted zones to reduce the exposure of the affected extension

bash

# Configuration example: block the vulnerable extension via Edge policy on Windows
# Set this registry key to prevent installation of the affected SAP GUI connector extension
reg add "HKLM\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallBlocklist" /v 1 /t REG_SZ /d "<EXTENSION_ID_OF_SAP_GUI_CONNECTOR>" /f