CVE-2025-24867 Overview
CVE-2025-24867 is a reflected Cross-Site Scripting (XSS) vulnerability in the SAP BusinessObjects Business Intelligence Platform, specifically in the BI Launchpad component. The application fails to sufficiently sanitize user-controlled input passed through an unprotected URL parameter. An unauthenticated attacker can craft a malicious URL that embeds JavaScript into the vulnerable parameter. When a victim clicks the link, the browser executes the injected script in the context of the BI Launchpad session. The flaw is tracked under CWE-79 and requires user interaction. Successful exploitation can disclose or modify web client information but does not affect service availability.
Critical Impact
An unauthenticated attacker can execute arbitrary JavaScript in a victim's browser, enabling session data theft, unauthorized actions in BI Launchpad, and phishing or credential harvesting through a single crafted URL.
Affected Products
- SAP BusinessObjects Business Intelligence Platform
- BI Launchpad component
- Refer to SAP Note #3445708 for the specific supported versions
Discovery Timeline
- 2025-02-11 - CVE-2025-24867 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in the NVD database
Technical Details for CVE-2025-24867
Vulnerability Analysis
The vulnerability is a reflected XSS flaw in the BI Launchpad web interface of the SAP BusinessObjects Business Intelligence Platform. BI Launchpad accepts input through a URL parameter without applying adequate output encoding or input validation. An attacker constructs a URL containing script content within the unprotected parameter and delivers it to a target user through phishing, chat, or another channel.
When the victim visits the URL, the server reflects the malicious payload into the rendered response. The browser then executes the script under the origin of the BI Launchpad application. Because the attack requires no authentication, the attacker only needs a valid target URL and a user willing to click.
The scope of the vulnerability is changed, meaning the injected script executes with access to resources beyond the vulnerable component itself. Consequences include theft of session cookies, forged requests against BusinessObjects functionality, defacement of the interface, and delivery of secondary payloads. Availability of the platform is not affected.
Root Cause
The root cause is insufficient neutralization of input during web page generation [CWE-79]. A URL parameter processed by BI Launchpad is written into HTML responses without proper contextual encoding, allowing attacker-supplied markup and script tags to be interpreted by the browser rather than rendered as text.
Attack Vector
The attack vector is network-based and requires user interaction. An attacker sends a crafted link pointing to a BI Launchpad endpoint with a script payload embedded in the vulnerable parameter. Upon click, the payload executes in the victim's authenticated or unauthenticated browser session. See SAP Note #3445708 and the SAP Security Patch Day Announcement for vendor-supplied technical details.
Detection Methods for CVE-2025-24867
Indicators of Compromise
- Web server or reverse proxy logs containing BI Launchpad request URLs with encoded or literal script fragments such as <script>, onerror=, javascript:, or %3Cscript%3E in query parameters.
- Unusual referrers to BI Launchpad endpoints originating from external chat, mail, or link-shortening services.
- Client-side error reports or Content Security Policy violation reports referencing inline script execution on BI Launchpad pages.
Detection Strategies
- Deploy web application firewall (WAF) signatures that flag reflected XSS patterns in query strings targeting BI Launchpad paths.
- Correlate SAP BusinessObjects HTTP access logs with endpoint browser telemetry to identify users who followed suspicious BI Launchpad URLs.
- Hunt for outbound requests from user endpoints to attacker-controlled domains immediately after visiting a BI Launchpad URL, indicating possible cookie or data exfiltration.
Monitoring Recommendations
- Enable verbose HTTP request logging on the BusinessObjects web tier and forward logs to a SIEM for query-parameter inspection.
- Monitor for spikes in 4xx and 5xx responses on BI Launchpad endpoints that may indicate payload probing.
- Alert on Content Security Policy violation reports and browser-side script errors originating from the BusinessObjects application origin.
How to Mitigate CVE-2025-24867
Immediate Actions Required
- Apply the SAP-provided patch referenced in SAP Note #3445708 to affected SAP BusinessObjects Business Intelligence Platform installations.
- Restrict external access to BI Launchpad through VPN, allowlisted networks, or reverse proxy controls until the patch is deployed.
- Communicate the phishing risk to BusinessObjects users and instruct them not to click BI Launchpad links from untrusted sources.
Patch Information
SAP released fixes as part of its Security Patch Day cycle. Administrators must download and apply the correction documented in SAP Note #3445708. Consult the SAP Security Patch Day Announcement for the corresponding patch bundle and supported version matrix. Verify successful installation and restart the affected services after patching.
Workarounds
- Configure a WAF or reverse proxy rule to strip or reject BI Launchpad request parameters containing HTML tags, script, onerror, onload, or javascript: tokens.
- Enforce a strict Content Security Policy that disallows inline scripts and untrusted script sources on BusinessObjects web pages.
- Set the HttpOnly and Secure attributes on BusinessObjects session cookies to reduce the impact of script-based cookie theft.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
