CVE-2025-24872: SAP ABAP Platform Auth Bypass Vulnerability

CVE-2025-24872 Overview

CVE-2025-24872 is an authorization flaw in the ABAP Build Framework of the SAP ABAP Platform. An authenticated attacker can gain unauthorized access to a specific transaction by invoking the add-on build functionality. Successful exploitation allows the attacker to call the transaction and view its details, exposing information that should be restricted by role-based access controls. The weakness is categorized as improper authorization [CWE-863] and affects confidentiality only, with no impact on integrity or availability.

Critical Impact
An authenticated SAP user can bypass transaction-level authorization checks through the ABAP Build Framework and view restricted transaction details.

Affected Products

SAP ABAP Platform (ABAP Build Framework component)
Refer to SAP Security Note #3553753 for exact supported release and support package levels

Discovery Timeline

2025-02-11 - CVE-2025-24872 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24872

Vulnerability Analysis

The ABAP Build Framework provides tooling for assembling add-on packages within the SAP ABAP Platform. The add-on build workflow invokes a specific transaction without re-validating the caller's authorization against the transaction's own access control object. An authenticated user with permission to execute the build functionality inherits an implicit path to that transaction and can retrieve its content.

Because the issue is scoped to confidentiality, the attacker cannot modify records or disrupt service through this flaw. The exposed information may include transaction metadata and operational details that aid reconnaissance for further attacks against SAP business processes.

Root Cause

The root cause is an improper authorization check [CWE-863] in the add-on build code path. The framework trusts that a user authorized to run a build is also authorized for every transaction the build invokes. Standard SAP authority checks that normally gate direct transaction execution are bypassed when the transaction is reached through the build functionality.

Attack Vector

Exploitation requires network access to the SAP system and valid user credentials with privileges to execute the ABAP Build Framework's add-on build. No user interaction is required beyond the attacker's own session. The attacker triggers the add-on build workflow, which calls the restricted transaction on their behalf and returns its details to the session. The EPSS score is 0.259% at the 16.564 percentile, indicating low current probability of mass exploitation.

No public proof-of-concept code or exploit tooling is listed in the vendor advisory. See the SAP Security Note #3553753 for the detailed technical description.

Detection Methods for CVE-2025-24872

Indicators of Compromise

Unexpected invocations of the ABAP Build Framework add-on build functionality by users who do not normally perform add-on packaging work
Audit log entries showing access to the restricted transaction originating from the build workflow rather than direct transaction codes
Repeated or scripted calls to the add-on build functionality from a single user session within a short time window

Detection Strategies

Enable and review the SAP Security Audit Log (SM19/SM20) for transaction starts and RFC calls tied to the ABAP Build Framework
Correlate build framework activity with the identity of the executing user and compare against expected development or release roles
Baseline normal usage of add-on build operations per user and alert on deviations

Monitoring Recommendations

Forward SAP Security Audit Log and change document data to a centralized SIEM for correlation with identity events
Monitor assignments and usage of authorization objects granting access to the ABAP Build Framework
Alert on first-time use of the add-on build functionality by any account outside the designated build operator group

How to Mitigate CVE-2025-24872

Immediate Actions Required

Apply the SAP-provided correction described in SAP Security Note #3553753 during the next available maintenance window
Audit all accounts authorized to execute the ABAP Build Framework and remove privileges from users who do not require them
Review access to the specific transaction exposed by the build workflow and confirm authorization objects match the principle of least privilege

Patch Information

SAP released a fix as part of its monthly Security Patch Day. Customers should consult SAP Security Note #3553753 and the SAP Security Patch Day Announcement for the exact support packages and kernel levels required for their deployed ABAP Platform release.

Workarounds

Restrict the authorization object controlling execution of the ABAP Build Framework add-on build functionality to a small, named group of build operators
Disable or remove the add-on build capability in production systems where it is not required for business operations
Enforce segregation of duties so that developers with build permissions do not also hold privileges that could amplify the disclosed transaction data

bash

# Configuration example
# Review authorizations granting ABAP Build Framework access using SAP transaction SUIM
# Report: Users by Complex Selection Criteria -> filter by relevant authorization object
# Remove unnecessary assignments via PFCG and re-generate affected roles