CVE-2025-0060: SAP BusinessObjects BI Platform XSS Flaw

CVE-2025-0060 Overview

CVE-2025-0060 is a Code Injection vulnerability affecting SAP BusinessObjects Business Intelligence Platform. The vulnerability allows an authenticated user with restricted access to inject malicious JavaScript code which can read sensitive information from the server and send it to the attacker. The attacker could further use this information to impersonate a high-privileged user, causing significant impact on confidentiality and integrity of the application.

Critical Impact
Authenticated attackers with restricted access can inject malicious JavaScript code to steal sensitive information and impersonate high-privileged users, leading to complete compromise of application confidentiality and integrity.

Affected Products

SAP BusinessObjects Business Intelligence Platform 420 (Enterprise Edition)
SAP BusinessObjects Business Intelligence Platform 430
SAP BusinessObjects Business Intelligence Platform 2025

Discovery Timeline

January 14, 2025 - CVE-2025-0060 published to NVD
October 24, 2025 - Last updated in NVD database

Technical Details for CVE-2025-0060

Vulnerability Analysis

This vulnerability is classified under CWE-94 (Improper Control of Generation of Code), commonly known as Code Injection. The flaw exists in SAP BusinessObjects Business Intelligence Platform where user input is not properly sanitized before being processed, allowing an authenticated user—even one with restricted access—to inject arbitrary JavaScript code into the application.

The attack requires network access and high-level privileges within the application context. Once exploited, the injected code executes within the context of the application, enabling the attacker to access sensitive server-side information. This stolen data can then be exfiltrated to an attacker-controlled server and subsequently used to impersonate users with elevated privileges.

The vulnerability has significant implications for organizations using SAP BI for critical business intelligence operations, as successful exploitation could lead to unauthorized access to sensitive business data, reports, and analytics.

Root Cause

The root cause of CVE-2025-0060 lies in improper input validation and output encoding within the SAP BusinessObjects Business Intelligence Platform. The application fails to adequately sanitize user-supplied input before incorporating it into dynamically generated code or output, creating an injection point for malicious JavaScript. This lack of proper input validation allows attackers to break out of the intended data context and inject executable code.

Attack Vector

The attack is conducted over the network by an authenticated user who possesses restricted access to the SAP BusinessObjects platform. The attacker crafts malicious JavaScript payloads designed to:

Execute within the application's trusted context
Access and read sensitive server-side information
Exfiltrate the captured data to an external attacker-controlled endpoint
Enable the attacker to impersonate high-privileged users using the stolen information

The exploitation requires no user interaction beyond the attacker's own authenticated session, making it relatively straightforward to execute once access is obtained.

Detection Methods for CVE-2025-0060

Indicators of Compromise

Unusual JavaScript execution patterns or unexpected script tags in application responses
Network traffic to unknown external endpoints originating from the SAP BI server
Unexpected privilege escalation or session anomalies for restricted user accounts
Audit log entries showing restricted users accessing high-privilege resources

Detection Strategies

Implement Web Application Firewall (WAF) rules to detect and block common JavaScript injection patterns
Enable and monitor SAP BusinessObjects audit logs for suspicious user activity and access patterns
Deploy network monitoring to identify data exfiltration attempts from the SAP BI environment
Configure SIEM alerts for anomalous user behavior, particularly privilege escalation indicators

Monitoring Recommendations

Regularly review SAP BusinessObjects security audit logs for injection attempts and unusual access patterns
Monitor outbound network connections from the SAP BI server for suspicious data transfers
Implement real-time alerting for unauthorized access attempts to sensitive reports and data sources
Track user session behavior to identify potential impersonation or privilege abuse

How to Mitigate CVE-2025-0060

Immediate Actions Required

Apply the security patch referenced in SAP Note #3474398 immediately
Review and restrict user access permissions to minimize the attack surface
Enable enhanced logging and monitoring for the SAP BusinessObjects environment
Audit all user accounts with restricted access for suspicious activity

Patch Information

SAP has released a security patch addressing CVE-2025-0060 as part of their Security Patch Day updates. Organizations should obtain the patch from SAP Note #3474398 and apply it to all affected versions of SAP BusinessObjects Business Intelligence Platform (versions 420, 430, and 2025). For complete patch information and additional security guidance, refer to the SAP Security Patch Day Information portal.

Workarounds

Implement strict Content Security Policy (CSP) headers to limit script execution sources
Deploy a Web Application Firewall with rules to filter potential JavaScript injection attempts
Restrict network access to the SAP BI platform using firewall rules and network segmentation
Apply the principle of least privilege to all user accounts, minimizing access for restricted users

bash

# Example: Review SAP BusinessObjects user permissions
# Check for users with restricted access levels
# Audit script execution permissions in application configuration
# Verify Content Security Policy headers are properly configured