CVE-2024-25642: SAP Cloud Connector Info Disclosure Flaw

CVE-2024-25642 Overview

CVE-2024-25642 is an improper certificate validation vulnerability [CWE-295] in SAP Cloud Connector (SCC) version 2.0. The flaw breaks mutual TLS authentication between SCC and backend servers. An attacker positioned on the network can present a forged certificate and impersonate a legitimate server. Once trusted, the attacker intercepts and modifies traffic flowing through the connector.

The vulnerability affects confidentiality and integrity of data traversing SCC tunnels but does not impact system availability. SAP addressed the issue through SAP Security Note #3424610.

Critical Impact
Attackers can perform man-in-the-middle attacks against SAP Cloud Connector traffic, intercepting and modifying sensitive business data exchanged between cloud and on-premise systems.

Affected Products

SAP Cloud Connector version 2.0
Deployments relying on SCC mutual authentication for cloud-to-on-premise integration
SAP BTP (Business Technology Platform) tenants connected through vulnerable SCC instances

Discovery Timeline

2024-02-13 - CVE-2024-25642 published to the National Vulnerability Database
2024-05 - Full Disclosure post published on seclists.org
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-25642

Vulnerability Analysis

SAP Cloud Connector acts as a reverse invoke proxy between SAP Business Technology Platform tenants and on-premise systems. It establishes mutual TLS (mTLS) sessions where both endpoints authenticate one another using X.509 certificates. This mutual authentication is the primary trust boundary protecting on-premise resources exposed through the connector.

In version 2.0, SCC does not adequately validate the server certificate presented during TLS negotiation. Certificate chain verification, hostname validation, or trust anchor checks are incomplete. As a result, a certificate that would normally be rejected can be accepted as valid.

An attacker with a network position between SCC and the intended server can present a certificate they control. SCC accepts the connection, and the attacker relays traffic while observing and altering payloads. Sensitive business data, credentials, and API tokens transported through the tunnel become exposed.

Root Cause

The root cause is improper certificate validation [CWE-295] in the TLS client logic of SCC 2.0. The connector fails to enforce full X.509 validation semantics required to guarantee peer identity, breaking the mutual authentication contract.

Attack Vector

Exploitation requires an attacker to intercept network traffic between the Cloud Connector and its remote peer. This is a network attack vector with high complexity because the attacker must achieve a suitable on-path position. No authentication or user interaction is required to exploit the flaw once positioning is established. See the Full Disclosure post for additional technical context.

Detection Methods for CVE-2024-25642

Indicators of Compromise

Unexpected TLS certificates presented to SCC that do not chain to previously trusted issuers
Anomalous outbound TLS connections from the SCC host to non-approved IP addresses or hostnames
Log entries in SCC audit logs showing certificate warnings, renegotiations, or connection resets to backend systems
Sudden changes in TLS session duration or throughput patterns for established SCC tunnels

Detection Strategies

Monitor SCC audit logs and scc_daemon logs for certificate handshake anomalies and unexpected peer identities
Deploy TLS inspection at network egress points to compare presented certificates against an approved allowlist
Correlate SCC connection metadata with authoritative DNS and PKI inventories to identify impostor endpoints
Track process and network telemetry from the SCC host for outbound flows that deviate from baseline destinations

Monitoring Recommendations

Enable verbose TLS logging on SCC and forward events to a centralized SIEM for retention and correlation
Alert on any change to the SCC trust store, keystore files, or .jks configuration artifacts
Baseline the set of backend systems SCC connects to and alert on new destinations or certificate issuers
Review SAP Security Note #3424610 for vendor-specified log signatures indicating exploitation attempts

How to Mitigate CVE-2024-25642

Immediate Actions Required

Upgrade SAP Cloud Connector to a fixed version as directed by SAP Note #3424610
Rotate any credentials, API keys, or certificates that traversed SCC 2.0 tunnels prior to patching
Restrict network paths between SCC and backend systems to reduce opportunity for on-path attackers
Audit the SCC trust store and remove any unnecessary or unknown certificate authorities

Patch Information

SAP released a fix through SAP Security Note #3424610. Administrators should download the current SCC release from the SAP Software Download Center and follow the upgrade procedure in the SAP Cloud Connector security documentation. Verify the installed version after upgrade and confirm mutual TLS is enforced end to end.

Workarounds

Place SCC and its backend systems on a dedicated, segmented network to limit exposure to man-in-the-middle positioning
Enforce IPsec or an additional VPN tunnel underneath the SCC connection to add a second authentication layer
Restrict SCC outbound connections to explicit destination IP addresses using host-based or perimeter firewall rules
Increase audit log retention and review frequency until patching is complete

bash

# Verify installed SAP Cloud Connector version on Linux
cat /opt/sap/scc/scc_config/version.properties

# Restrict outbound connectivity from the SCC host to approved backends only
sudo iptables -A OUTPUT -o eth0 -p tcp -d <approved-backend-ip> --dport 443 -j ACCEPT
sudo iptables -A OUTPUT -o eth0 -p tcp --dport 443 -j DROP