CVE-2025-0061: SAP BusinessObjects Auth Bypass Vulnerability

CVE-2025-0061 Overview

CVE-2025-0061 is a critical information disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform that enables unauthenticated attackers to perform session hijacking over the network. This vulnerability requires no user interaction and allows attackers to access and modify all application data, representing a severe threat to enterprise business intelligence environments.

Critical Impact
Unauthenticated attackers can hijack user sessions remotely without any user interaction, gaining complete access to read and modify all application data within the SAP BusinessObjects platform.

Affected Products

SAP BusinessObjects Business Intelligence Platform 420 (Enterprise)
SAP BusinessObjects Business Intelligence Platform 430
SAP BusinessObjects Business Intelligence Platform 2025

Discovery Timeline

2025-01-14 - CVE-2025-0061 published to NVD
2025-10-24 - Last updated in NVD database

Technical Details for CVE-2025-0061

Vulnerability Analysis

This vulnerability falls under CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), indicating that the SAP BusinessObjects platform inadvertently exposes sensitive session-related information to unauthorized parties. The information disclosure allows attackers to obtain session tokens or credentials that can be leveraged to hijack legitimate user sessions.

The attack can be executed remotely over the network with low complexity and requires no privileges or user interaction, making it highly exploitable in enterprise environments where SAP BusinessObjects is typically deployed.

Root Cause

The root cause is an information disclosure vulnerability where sensitive session data is exposed to unauthorized actors. The SAP BusinessObjects Business Intelligence Platform fails to properly protect session-related information, allowing attackers to intercept or access session tokens that should be kept confidential. This exposure enables session hijacking attacks where an attacker can assume the identity of a legitimate user.

Attack Vector

The attack vector is network-based, allowing remote exploitation. An unauthenticated attacker can exploit this vulnerability by:

Identifying an exposed SAP BusinessObjects Business Intelligence Platform instance
Exploiting the information disclosure vulnerability to obtain valid session information
Using the obtained session data to hijack an active user session
Accessing and modifying application data with the privileges of the hijacked session

The vulnerability does not require any authentication or user interaction, making it particularly dangerous for internet-facing deployments.

Detection Methods for CVE-2025-0061

Indicators of Compromise

Unusual session activity patterns, including multiple concurrent sessions from different IP addresses using the same session token
Unexpected geographic locations or IP addresses accessing SAP BusinessObjects sessions
Anomalous data access or modification patterns that deviate from normal user behavior
Session tokens being accessed or used without corresponding authentication events

Detection Strategies

Monitor authentication and session management logs for signs of session hijacking, such as session reuse from different IP addresses
Implement network traffic analysis to detect abnormal patterns in communication with SAP BusinessObjects servers
Deploy intrusion detection rules targeting unauthorized session token access attempts
Enable comprehensive audit logging within SAP BusinessObjects to track all session creation and usage events

Monitoring Recommendations

Configure real-time alerting for multiple session access attempts from disparate network locations
Establish baseline user behavior profiles and alert on significant deviations in data access patterns
Monitor for reconnaissance activities targeting SAP BusinessObjects endpoints
Implement network segmentation monitoring to detect lateral movement attempts following session compromise

How to Mitigate CVE-2025-0061

Immediate Actions Required

Review SAP Note #3474398 and apply the recommended security patches immediately
Restrict network access to SAP BusinessObjects servers using firewall rules and network segmentation
Audit all active sessions and terminate any suspicious or potentially compromised sessions
Implement additional authentication controls such as multi-factor authentication where supported

Patch Information

SAP has released security patches addressing this vulnerability as part of their Security Patch Day. Organizations should consult the SAP Security Patch Day portal and apply the latest patches for SAP BusinessObjects Business Intelligence Platform versions 420, 430, and 2025. Detailed remediation guidance is available in SAP Note #3474398.

Workarounds

Restrict access to SAP BusinessObjects servers to trusted internal networks only until patches can be applied
Implement web application firewall (WAF) rules to detect and block potential exploitation attempts
Enable enhanced session validation and reduce session timeout values to minimize the window for session hijacking
Deploy network monitoring to detect and respond to suspicious session activity in real-time