CVE-2024-25645: SAP NetWeaver Portal Information Disclosure

CVE-2024-25645 Overview

CVE-2024-25645 affects SAP NetWeaver Enterprise Portal version 7.50. Under certain conditions, an unauthenticated remote attacker can access information that would otherwise be restricted. The flaw is categorized under [CWE-732] Incorrect Permission Assignment for Critical Resource. Exploitation impacts confidentiality only, with no effect on integrity or availability of the application. SAP addressed the issue in SAP Security Note #3428847.

Critical Impact
Remote attackers can retrieve restricted information from SAP NetWeaver Enterprise Portal without authentication or user interaction, exposing potentially sensitive portal data.

Affected Products

SAP NetWeaver Enterprise Portal version 7.50
Deployments exposing the affected Enterprise Portal component to network access
SAP environments that have not applied SAP Security Note #3428847

Discovery Timeline

2024-03-12 - CVE-2024-25645 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-25645

Vulnerability Analysis

CVE-2024-25645 is an information disclosure vulnerability in SAP NetWeaver Enterprise Portal 7.50. The flaw allows a remote, unauthenticated attacker to obtain data that access controls should protect. Only confidentiality is affected; the application's integrity and availability remain intact.

The attack vector is network-based and requires no privileges or user interaction. Exploitation is straightforward when the vulnerable portal component is reachable over the network. SAP classifies the issue under its March 2024 Security Patch Day advisories.

Root Cause

The underlying weakness maps to [CWE-732], Incorrect Permission Assignment for Critical Resource. Enterprise Portal grants access to a resource with permissions that are broader than intended. Under specific conditions, unauthorized callers can read information that the portal should restrict to authenticated or authorized users.

Attack Vector

An attacker interacts with the affected Enterprise Portal endpoint over the network. No credentials are required, and the request pattern is low in complexity. The successful request returns restricted information from the portal. SAP has not publicly documented the exact triggering conditions, and no public proof-of-concept exploit is available at this time.

See the SAP Security Note #3428847 for the vendor's technical description and required preconditions.

Detection Methods for CVE-2024-25645

Indicators of Compromise

Unauthenticated HTTP or HTTPS requests to SAP NetWeaver Enterprise Portal endpoints returning non-empty responses
Anomalous access patterns from external IP ranges targeting Enterprise Portal URIs
Portal access log entries lacking associated authenticated session identifiers

Detection Strategies

Review SAP NetWeaver Enterprise Portal access logs for unauthenticated requests that return substantive response bodies
Correlate reverse proxy and web application firewall logs against portal server logs to identify unauthorized information retrieval
Baseline typical portal request patterns and alert on deviations against unauthenticated endpoints

Monitoring Recommendations

Ingest SAP NetWeaver Enterprise Portal logs into a centralized SIEM or data lake for continuous review
Enable SAP Security Audit Log and monitor for repeated anonymous access attempts against sensitive portal paths
Track outbound data volumes from Enterprise Portal hosts to detect bulk information retrieval

How to Mitigate CVE-2024-25645

Immediate Actions Required

Apply the fix described in SAP Security Note #3428847 to all SAP NetWeaver Enterprise Portal 7.50 systems
Inventory Enterprise Portal instances exposed to untrusted networks and prioritize patching internet-facing systems
Review portal access logs from before patch deployment for signs of unauthorized information access

Patch Information

SAP released the fix in SAP Security Note #3428847, published as part of the March 2024 SAP Security Patch Day. Administrators can retrieve the note through the SAP Support Portal. Apply the corrective note through the standard SAP patch process and validate the update against the affected components.

Workarounds

Restrict network access to SAP NetWeaver Enterprise Portal to trusted networks and VPN users until patching completes
Place a web application firewall in front of the portal to block unauthenticated access to sensitive paths
Disable or restrict the affected portal component if it is not required for business operations

bash

# Configuration example
# Restrict portal access at the network layer while patching is scheduled
# Example iptables rule limiting Enterprise Portal to a management subnet
iptables -A INPUT -p tcp --dport 50000 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 50000 -j DROP