CVE-2025-23192: SAP BusinessObjects BI XSS Vulnerability

CVE-2025-23192 Overview

CVE-2025-23192 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in SAP BusinessObjects Business Intelligence (BI Workspace). An attacker with low privileges can craft and store malicious script content within a workspace. When a victim subsequently accesses the affected workspace, the script executes in the victim's browser context.

Successful exploitation allows access to sensitive session information and limited modification of browser-rendered content. The flaw produces a scope change because script execution crosses the trust boundary between the BI Workspace and the victim's browser session.

Critical Impact
Authenticated attackers can hijack BI Workspace sessions, exfiltrate session tokens, and manipulate dashboards rendered to other users, including administrators.

Affected Products

SAP BusinessObjects Business Intelligence Enterprise 4.3
SAP BusinessObjects Business Intelligence 2025
SAP BusinessObjects Business Intelligence 2027

Discovery Timeline

2025-06-10 - CVE-2025-23192 published to NVD
2025-10-23 - Last updated in NVD database

Technical Details for CVE-2025-23192

Vulnerability Analysis

The vulnerability resides in the BI Workspace component of SAP BusinessObjects Business Intelligence. The component fails to properly sanitize or encode user-supplied content before storing it in a workspace object. When the workspace is rendered, the unsanitized content is served back to viewers and executed as active script in their browsers.

Because the payload is stored server-side, every user who opens the affected workspace triggers execution. The Exploit Prediction Scoring System (EPSS) places this issue at the 58th percentile, indicating moderate likelihood of attempted exploitation in the near term.

Root Cause

The root cause is insufficient output encoding and input validation on workspace content fields. SAP BusinessObjects does not enforce contextual escaping when persisting and rendering workspace markup, allowing script tags and event handlers to survive the storage and rendering pipeline intact.

Attack Vector

An attacker requires network access to the BI Workspace interface and low-privilege credentials sufficient to create or edit a workspace. The attacker injects a malicious script payload into a workspace field. The attack then waits for user interaction: a victim must navigate to the trapped workspace for the payload to fire.

Once executed, the script runs in the victim's authenticated session and can read session cookies that are not protected by HttpOnly, issue authenticated API calls on behalf of the victim, or alter dashboard content. The vulnerability description confirms a high confidentiality impact and low integrity impact, with no direct availability impact.

No public proof-of-concept code is available for CVE-2025-23192 at the time of writing.

Detection Methods for CVE-2025-23192

Indicators of Compromise

Workspace objects containing <script> tags, javascript: URIs, or DOM event handler attributes such as onerror, onload, or onmouseover in stored content fields.
Unexpected outbound HTTP requests from BI Workspace user sessions to attacker-controlled domains carrying session identifiers or BOE cookies.
Workspace modifications performed by low-privilege accounts immediately followed by access from privileged users.

Detection Strategies

Inspect BI Workspace audit logs for workspace create and modify events originating from accounts that do not normally author content.
Scan stored workspace definitions in the CMS repository for HTML and JavaScript patterns associated with XSS payloads.
Correlate browser-side Content Security Policy (CSP) violation reports with workspace access events to surface attempted script execution.

Monitoring Recommendations

Forward SAP BusinessObjects audit and access logs to a centralized SIEM with alerting on anomalous workspace edits.
Monitor for session token reuse from disparate IP addresses or user agents, which can indicate session theft via XSS.
Track outbound web proxy logs from user workstations for connections to newly registered or low-reputation domains following BI Workspace access.

How to Mitigate CVE-2025-23192

Immediate Actions Required

Apply the fix described in SAP Note #3560693 to all affected BusinessObjects Business Intelligence deployments.
Restrict workspace creation and edit permissions to vetted authors until patching is complete.
Invalidate active BI Workspace sessions and force re-authentication after patch deployment.

Patch Information

SAP released the fix through the June 2025 Security Patch Day. Administrators should consult SAP Note #3560693 and the SAP Security Patch Day Update for download links and version-specific instructions covering BusinessObjects BI 4.3, 2025, and 2027.

Workarounds

Enforce a strict Content Security Policy on the BI Launchpad and Workspace endpoints to block inline script execution.
Set the HttpOnly and Secure flags on all BusinessObjects session cookies to reduce token theft impact.
Audit and remove existing workspaces authored by untrusted or shared accounts before re-enabling user access.

bash

# Configuration example: harden response headers at the reverse proxy fronting BI Launchpad
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'self'" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;