CVE-2025-0054: SAP NetWeaver Java Stored XSS Vulnerability

CVE-2025-0054 Overview

CVE-2025-0054 is a stored cross-site scripting (XSS) vulnerability in SAP NetWeaver Application Server Java. The application fails to sufficiently sanitize user-supplied input before persisting it, allowing an authenticated attacker with basic user privileges to store a JavaScript payload on the server. When another user loads the affected page, the browser executes the payload in the victim's session context. An attacker can read or modify information tied to the vulnerable web page, including data visible to higher-privileged users who trigger the payload.

Critical Impact
Authenticated attackers can persist JavaScript in SAP NetWeaver AS Java, executing code in victims' browsers and pivoting across a scope change to compromise session data and page content.

Affected Products

SAP NetWeaver Application Server Java
Refer to SAP Note #3526203 for the specific affected component versions
See the SAP Security Patch Day Announcement for the full patch listing

Discovery Timeline

2025-02-11 - CVE-2025-0054 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0054

Vulnerability Analysis

The flaw is classified as Improper Neutralization of Input During Web Page Generation [CWE-79], commonly known as stored cross-site scripting. SAP NetWeaver Application Server Java accepts user-controlled input through an authenticated interface and stores it without proper encoding or sanitization. When the stored value is later rendered in the web UI, the browser interprets it as executable JavaScript instead of literal content.

Exploitation requires an authenticated session with basic user privileges and user interaction from a victim who loads the affected page. The scope changes when the payload runs in the victim's browser, meaning the exploit reaches resources outside the vulnerable component's original security boundary. Successful exploitation affects confidentiality and integrity of information tied to the rendered page, but does not directly impact availability.

Root Cause

The underlying issue is missing output encoding on a data field that persists user input server-side. The application trusts stored content when generating HTML responses, allowing <script> tags or event handler attributes to render as active script. Because the payload is stored rather than reflected, every subsequent request that renders the field re-triggers execution against new victims.

Attack Vector

An attacker authenticates to SAP NetWeaver AS Java with a low-privileged account and submits a crafted JavaScript payload into a vulnerable input field. The server persists the payload in its data store. When a victim, potentially an administrator, navigates to the page that renders the stored value, the browser executes the attacker's script under the victim's origin. The attacker can then exfiltrate session tokens, read DOM content, or issue authenticated requests on behalf of the victim.

No verified public proof-of-concept code is available. See SAP Note #3526203 for vendor-provided technical details.

Detection Methods for CVE-2025-0054

Indicators of Compromise

HTTP POST or PUT requests to SAP NetWeaver AS Java endpoints containing <script>, javascript:, onerror=, or onload= substrings in form fields
Unexpected outbound requests from user browsers to attacker-controlled domains shortly after loading an SAP AS Java page
Stored records in SAP application tables containing HTML tags or encoded script fragments where plaintext is expected

Detection Strategies

Inspect web application firewall (WAF) and reverse proxy logs for XSS payload signatures targeting SAP NetWeaver AS Java URLs
Review SAP application audit logs for anomalous data submissions from low-privileged accounts, particularly bulk edits to shared content
Correlate authenticated user actions with subsequent client-side redirects, cookie access patterns, or session anomalies affecting higher-privileged accounts

Monitoring Recommendations

Enable and centralize SAP Security Audit Log events for input-handling components on AS Java
Baseline normal input patterns for user-editable fields and alert on submissions containing HTML or JavaScript syntax
Monitor browser telemetry from workstations of privileged SAP users for unexpected script execution or credential access attempts

How to Mitigate CVE-2025-0054

Immediate Actions Required

Apply the SAP-provided patch referenced in SAP Note #3526203 as your first priority
Audit user-editable fields in SAP NetWeaver AS Java for stored HTML or script content and purge malicious entries
Review recent low-privilege account activity for suspicious data submissions preceding patch deployment

Patch Information

SAP addressed CVE-2025-0054 through its Security Patch Day release. Administrators must download and apply the fix documented in SAP Note #3526203. Consult the SAP Security Patch Day Announcement to confirm the correct patch level for your NetWeaver AS Java version and support package stack.

Workarounds

Restrict low-privileged user access to the vulnerable input functionality until patching is complete
Deploy a WAF rule set to block or sanitize HTML and JavaScript payloads submitted to SAP AS Java endpoints
Enforce a strict Content Security Policy (CSP) on SAP web interfaces to limit inline script execution
Require re-authentication for administrative actions to reduce impact if a session is hijacked via XSS

bash

# Example WAF rule fragment (ModSecurity-style) to block script tags in SAP AS Java form input
SecRule ARGS "@rx (?i)(<script|javascript:|onerror=|onload=)" \
    "id:1000054,phase:2,deny,status:403,log,\
    msg:'Potential XSS payload targeting SAP NetWeaver AS Java (CVE-2025-0054)'"