CVE-2025-0066: SAP Basis Information Disclosure Flaw

CVE-2025-0066 Overview

CVE-2025-0066 is a high-severity vulnerability affecting SAP NetWeaver Application Server for ABAP and ABAP Platform, specifically within the Internet Communication Framework (ICF). Under certain conditions, this vulnerability allows an attacker to access restricted information due to weak access controls. The flaw can have a significant impact on the confidentiality, integrity, and availability of affected SAP applications.

This vulnerability is classified as CWE-732 (Incorrect Permission Assignment for Critical Resource), indicating that the affected system fails to properly restrict access to sensitive resources. Attackers with low-privilege network access can exploit this weakness to gain unauthorized access to protected data and potentially compromise the entire SAP system.

Critical Impact

Authenticated attackers can exploit weak access controls in SAP NetWeaver's Internet Communication Framework to access restricted information, potentially compromising confidentiality, integrity, and availability of business-critical SAP applications across a wide range of SAP_BASIS versions.

Affected Products

• SAP NetWeaver AS for ABAP (SAP_BASIS versions 700, 701, 702)
• SAP NetWeaver AS for ABAP (SAP_BASIS versions 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758)
• SAP NetWeaver AS for ABAP (SAP_BASIS versions 912, 913, 914)

Discovery Timeline

• January 14, 2025 - CVE-2025-0066 published to NVD
• October 23, 2025 - Last updated in NVD database

Technical Details for CVE-2025-0066

Vulnerability Analysis

The vulnerability resides in the Internet Communication Framework (ICF) component of SAP NetWeaver AS for ABAP. The ICF is responsible for handling HTTP/HTTPS requests and routing them to appropriate handlers within the ABAP application server. The core issue stems from incorrect permission assignments that fail to adequately validate user authorization before granting access to protected resources.

When exploited, this vulnerability allows attackers with low-privilege authenticated access to bypass intended access restrictions. The attack requires network connectivity to the vulnerable SAP system but does not require user interaction, making it particularly dangerous in enterprise environments where SAP systems are accessible across corporate networks.

The impact is severe across all three security pillars: attackers can read confidential business data (confidentiality impact), potentially modify protected information (integrity impact), and disrupt system operations (availability impact).

Root Cause

The root cause of CVE-2025-0066 is improper access control implementation within the Internet Communication Framework. The vulnerability falls under CWE-732 (Incorrect Permission Assignment for Critical Resource), which occurs when the software assigns inappropriate read or write permissions to critical resources such as files, directories, or services.

In this case, the ICF fails to properly enforce authorization checks when handling certain requests, allowing authenticated users to access resources that should be restricted based on their privilege level. This represents a fundamental breakdown in the principle of least privilege that should govern all access control decisions within enterprise application servers.

Attack Vector

The attack vector for CVE-2025-0066 is network-based, requiring the attacker to have authenticated access to the SAP NetWeaver system. The exploitation path involves:

1. An attacker establishes an authenticated session to the vulnerable SAP NetWeaver AS for ABAP system
2. The attacker crafts requests targeting ICF endpoints that contain protected resources
3. Due to weak access controls, the system fails to properly validate whether the authenticated user has sufficient privileges
4. The attacker gains unauthorized access to restricted information or functionality

The vulnerability does not require any user interaction and has low attack complexity, meaning once an attacker has low-privilege credentials, exploitation is straightforward. The widespread deployment of SAP NetWeaver in enterprise environments and the extensive range of affected SAP_BASIS versions (spanning from version 700 to 914) significantly increases the potential attack surface.

Detection Methods for CVE-2025-0066

Indicators of Compromise

• Unusual access patterns to ICF services from low-privilege user accounts
• Unexpected authentication events followed by access to restricted SAP resources
• Anomalous HTTP/HTTPS requests targeting ICF endpoints outside of normal user behavior
• Audit log entries showing access to sensitive transactions or data by unauthorized users

Detection Strategies

• Monitor SAP Security Audit Log (SM21) for unauthorized access attempts to protected ICF services
• Implement network traffic analysis to detect anomalous request patterns to SAP NetWeaver HTTP ports
• Review user authorization profiles for excessive or inappropriate permissions that could facilitate exploitation
• Deploy SentinelOne Singularity XDR to detect behavioral anomalies associated with privilege abuse

Monitoring Recommendations

• Enable comprehensive logging for all ICF service access and authentication events
• Configure real-time alerts for access attempts to sensitive ICF handlers from unexpected user accounts
• Implement periodic reviews of SAP_BASIS access control configurations using transaction SICF
• Integrate SAP system logs with SIEM solutions for centralized monitoring and correlation

How to Mitigate CVE-2025-0066

Immediate Actions Required

• Apply the security patch referenced in SAP Note #3550708 immediately
• Review and audit current ICF service configurations using transaction SICF
• Implement network segmentation to restrict access to SAP NetWeaver systems to authorized users only
• Verify user authorization profiles follow the principle of least privilege

Patch Information

SAP has released a security patch to address CVE-2025-0066 as part of their Security Patch Day. Detailed patch information and installation instructions are available in SAP Note #3550708. Organizations should prioritize applying this patch across all affected SAP_BASIS versions, which include versions 700 through 758 and versions 912 through 914.

Administrators should consult the SAP Security Patch Day portal for the complete list of security updates and any additional dependencies or prerequisites for the patch installation.

Workarounds

• Restrict network access to SAP NetWeaver ICF services to only trusted IP ranges and users
• Disable unnecessary ICF services using transaction SICF to reduce the attack surface
• Implement additional authentication layers such as multi-factor authentication for SAP access
• Monitor and audit ICF service access logs while awaiting patch deployment

# Review ICF service status using SAP transaction
# Execute transaction SICF to review active ICF services
# Deactivate unnecessary services by right-clicking and selecting "Deactivate Service"

# Recommended: Export current ICF configuration for audit
# Navigate to: SICF -> Utilities -> Export Services

# Verify user authorizations for ICF access
# Execute transaction SU01 to review user master records
# Check authorization objects: S_ICF, S_ICF_ADM