CVE-2025-0057: SAP NetWeaver AS JAVA Stored XSS Vulnerability

CVE-2025-0057 Overview

CVE-2025-0057 is a stored cross-site scripting (XSS) vulnerability in the User Admin Application of SAP NetWeaver Application Server for Java (AS JAVA). An attacker with administrative privileges can upload a profile photo containing malicious JavaScript. The payload executes in the browser of any victim who visits the affected component. The attacker can then read and modify information within the scope of the victim's session. This weakness is categorized as [CWE-434] (Unrestricted Upload of File with Dangerous Type).

Critical Impact
A high-privileged attacker can persist JavaScript inside SAP NetWeaver AS JAVA, hijacking sessions of other administrators or users and altering data rendered in their browsers.

Affected Products

SAP NetWeaver Application Server for Java (AS JAVA)
User Admin Application component of SAP NetWeaver AS JAVA
Deployments identified in SAP Note #3514421

Discovery Timeline

2025-01-14 - CVE-2025-0057 published to NVD
2025-01-14 - SAP releases security patch via SAP Note #3514421 on Security Patch Day
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0057

Vulnerability Analysis

The flaw is a stored cross-site scripting issue in the User Admin Application of SAP NetWeaver AS JAVA. The application accepts a user profile photo upload but does not properly validate or sanitize the file contents. An attacker with administrative rights can substitute a crafted file that contains embedded JavaScript instead of legitimate image data. The server stores the file and later serves it to other users when they navigate to the vulnerable component. Because the malicious content is rendered in the victim's browser under the application's origin, the script executes with the victim's session context. Successful exploitation lets the attacker read data displayed to the victim, modify content on the page, or issue requests on the victim's behalf. The vulnerability requires user interaction, and its scope changes because the payload crosses trust boundaries between the uploader and the viewer.

Root Cause

The root cause is missing validation of uploaded file content in the User Admin Application. The component treats the uploaded photo as trusted binary data and does not enforce a strict MIME type check, magic-byte verification, or output-encoding when serving the resource. This maps to [CWE-434], where unrestricted file uploads become a vector for stored script injection.

Attack Vector

Exploitation requires network access to the User Admin Application and an administrator account. The attacker uploads a photo file containing JavaScript instead of valid image data. When another user loads a page that renders or references the file, the browser executes the embedded script. The scope change reflects that the injected code runs in the victim's browser context, not the attacker's.

No public proof-of-concept code has been verified for this issue. Refer to the SAP Note #3514421 for authoritative technical details.

Detection Methods for CVE-2025-0057

Indicators of Compromise

Profile photo files stored by the User Admin Application whose contents do not match a valid image format when inspected with magic-byte verification.
Uploaded files containing HTML tags, <script> blocks, or JavaScript event handlers such as onerror= and onload=.
Unexpected outbound HTTP requests from administrator browsers immediately after loading the User Admin Application.

Detection Strategies

Audit user administration upload endpoints for files whose declared MIME type does not match their actual content.
Review Content Security Policy (CSP) violation reports for the SAP NetWeaver AS JAVA hostnames.
Correlate administrator logins with subsequent uploads to the User Admin Application to identify unusual upload activity.

Monitoring Recommendations

Enable and forward SAP NetWeaver AS JAVA security audit logs to a central SIEM for retention and analysis.
Monitor administrator account activity for uploads occurring outside change windows or from unexpected source addresses.
Alert on repeated retrievals of the same uploaded photo resource by multiple privileged users in a short timeframe.

How to Mitigate CVE-2025-0057

Immediate Actions Required

Apply the fix described in SAP Note #3514421 to all affected SAP NetWeaver AS JAVA systems.
Review recently uploaded profile photos in the User Admin Application and remove any files whose contents are not valid images.
Rotate administrator credentials that may have been used to plant a malicious upload before the patch was applied.

Patch Information

SAP addressed the vulnerability on the January 2025 Security Patch Day. The corrective content is delivered through SAP Note #3514421. Additional context is available on the SAP Security Patch Day Announcement page. Customers should apply the note to every SAP NetWeaver AS JAVA instance that exposes the User Admin Application.

Workarounds

Restrict access to the User Admin Application to a minimal set of trusted administrators until the patch is deployed.
Enforce a Content Security Policy that blocks inline scripts and constrains script sources for the NetWeaver AS JAVA hostname.
Place SAP NetWeaver AS JAVA behind a web application firewall configured to inspect uploaded file contents and strip active content from non-image uploads.

bash

# Configuration example
# Review the official SAP Note #3514421 for authoritative remediation steps.
# General hardening guidance for uploads served by SAP NetWeaver AS JAVA:
#   1. Restrict who can access the User Admin Application via UME roles.
#   2. Enforce Content-Type validation on the reverse proxy or WAF.
#   3. Set a restrictive Content-Security-Policy response header, e.g.:
#      Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'