CVE-2025-0058: SAP Basis Information Disclosure Vulnerability

CVE-2025-0058 Overview

CVE-2025-0058 is an information disclosure vulnerability in SAP Business Workflow and SAP Flexible Workflow, components delivered through SAP sap_basis. An authenticated attacker can manipulate a parameter in an otherwise legitimate resource request to view sensitive information that should be restricted. The flaw is classified as [CWE-639] Authorization Bypass Through User-Controlled Key, commonly known as an Insecure Direct Object Reference (IDOR). The attacker cannot modify the information or affect its availability, so impact is limited to confidentiality. SAP addressed the issue as part of its January 2025 Security Patch Day.

Critical Impact
Authenticated users can access workflow data belonging to other users or business processes by tampering with request parameters, exposing potentially sensitive business information.

Affected Products

SAP NetWeaver Application Server ABAP (sap_basis) releases 753, 754, 755, 756, 757, 758
SAP NetWeaver Application Server ABAP (sap_basis) releases 912, 913, 914
SAP Business Workflow and SAP Flexible Workflow components running on the above sap_basis versions

Discovery Timeline

2025-01-14 - CVE-2025-0058 published to the National Vulnerability Database
2025-01-14 - SAP releases fix via SAP Note #3542698 on Security Patch Day
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0058

Vulnerability Analysis

The vulnerability resides in how SAP Business Workflow and SAP Flexible Workflow authorize access to workflow resources. The application validates the caller's session but fails to verify that the authenticated user is entitled to the specific workflow object referenced by the request parameter. By altering that parameter to a value belonging to another workflow instance, task, or business object, the attacker retrieves data outside their authorization scope. Because the flaw only affects read access, integrity and availability remain intact, but confidential workflow content, business context, and attached data may be exposed.

Root Cause

The root cause is an authorization check tied to user-controlled input, mapped to [CWE-639]. The workflow handler trusts the object identifier supplied by the client instead of enforcing a server-side authorization check that binds the caller's identity to the requested workflow object. This class of issue is often described as an Insecure Direct Object Reference and typically appears in business applications with granular per-object permissions.

Attack Vector

Exploitation requires network access to the SAP application server and valid low-privileged credentials. No user interaction is needed. The attacker sends a legitimate workflow request through a supported SAP protocol such as HTTP/HTTPS to the ABAP stack, then modifies an identifier parameter (for example a workflow ID, task ID, or work item key) to a value they should not be able to read. The server returns the associated data without re-validating ownership or role assignment.

No public exploit code or proof-of-concept has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See SAP Note #3542698 for the vendor's technical details.

Detection Methods for CVE-2025-0058

Indicators of Compromise

Repeated workflow API or ABAP web service requests from a single session iterating through sequential or randomized workflow identifiers.
Access to workflow items where the requesting user is neither the initiator, agent, nor authorized viewer in the SAP workflow tables.
HTTP 200 responses to workflow resource requests immediately following parameter mutation attempts from the same user session.

Detection Strategies

Enable SAP Security Audit Log (SM19/RSAU_CONFIG) to record RFC and HTTP calls to workflow function modules and services, and alert on anomalous access volumes per user.
Correlate ABAP Read Access Logging (RAL) data for workflow tables with the calling user's authorization profile to surface out-of-scope reads.
Baseline normal workflow interaction patterns per role and flag deviations such as bulk enumeration of work item IDs.

Monitoring Recommendations

Ingest SAP Security Audit Log, Gateway Log, and HTTP access logs into a centralized analytics platform for correlation across sessions.
Monitor for privilege reconnaissance patterns following authentication events from service accounts or low-privileged business users.
Track application response sizes for workflow endpoints; sudden increases in unique object IDs accessed per user warrant review.

How to Mitigate CVE-2025-0058

Immediate Actions Required

Apply the fix delivered in SAP Note #3542698 to all affected sap_basis releases in production, test, and development systems.
Review SAP role assignments for Business Workflow and Flexible Workflow authorization objects and remove excess privileges from standard users.
Audit recent workflow access logs for suspicious enumeration patterns predating the patch deployment.

Patch Information

SAP published the fix on the January 2025 Security Patch Day. Customers must implement SAP Note #3542698 on sap_basis versions 753, 754, 755, 756, 757, 758, 912, 913, and 914. Refer to the SAP Security Patch Day Update for the corresponding support package levels and manual correction instructions.

Workarounds

If patching must be deferred, restrict access to workflow transactions and services (for example SWI* transactions and workflow OData/HTTP endpoints) to only users with a documented business need.
Tighten authorization checks in custom workflow wrappers to re-validate ownership of the requested work item before returning data.
Place the SAP application server behind a Web Application Firewall or SAP Web Dispatcher rules that inspect and rate-limit workflow parameter enumeration attempts.

bash

# Verify installed sap_basis support package level before and after applying SAP Note #3542698
# Run in SAP GUI transaction SPAM or via ABAP report
SE38 -> RSPFPAR
# Or query the component version
SELECT COMPONENT, RELEASE, EXTRELEASE FROM CVERS WHERE COMPONENT = 'SAP_BASIS'.