CVE-2025-24874: SAP Commerce Clickjacking Vulnerability

CVE-2025-24874 Overview

CVE-2025-24874 affects SAP Commerce (Backoffice), which relies on the deprecated X-FRAME-OPTIONS HTTP response header to defend against clickjacking attacks. The header currently blocks framing attempts in modern browsers, but browser vendors may drop support in favor of the Content Security Policy (CSP) frame-ancestors directive. If browser support is removed, attackers could frame the Backoffice interface inside an attacker-controlled page and trick authenticated administrators into performing unintended actions. The result would be exposure and modification of sensitive administrative data. The issue is tracked under CWE-1021: Improper Restriction of Rendered UI Layers or Frames.

Critical Impact
Future browser deprecation of X-FRAME-OPTIONS could enable clickjacking against SAP Commerce Backoffice, allowing attackers to trick authenticated administrators into disclosing or modifying sensitive business data.

Affected Products

SAP Commerce (Backoffice)
Deployments relying on the X-FRAME-OPTIONS header for framing protection
Environments without a CSP frame-ancestors directive configured

Discovery Timeline

2025-02-11 - CVE-2025-24874 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24874

Vulnerability Analysis

SAP Commerce Backoffice sends the X-FRAME-OPTIONS response header to prevent its pages from being rendered inside <iframe>, <frame>, <object>, or <embed> elements on external sites. This header is a legacy mechanism that predates CSP and has been formally deprecated in favor of the CSP frame-ancestors directive. While current browsers honor X-FRAME-OPTIONS, the specification does not guarantee future support.

When browsers stop enforcing the header, an attacker who hosts a malicious page can embed the Backoffice UI inside a transparent frame. Overlaying deceptive content on top of that frame allows the attacker to hijack clicks and keystrokes from an authenticated administrator. Because the Backoffice manages product catalogs, pricing, orders, and customer data, hijacked interactions can lead to unauthorized data disclosure and modification.

Exploitation requires user interaction and depends on future browser behavior, which raises attack complexity. Confidentiality and integrity impacts remain high because the targeted user is typically a privileged administrator.

Root Cause

The root cause is reliance on a deprecated security control instead of the modern CSP frame-ancestors directive. X-FRAME-OPTIONS supports only DENY, SAMEORIGIN, and the removed ALLOW-FROM values, and browser vendors have signaled a preference for CSP-based framing controls. SAP Commerce Backoffice does not emit a frame-ancestors policy alongside the legacy header, leaving no fallback protection.

Attack Vector

Exploitation is network-based and requires an authenticated Backoffice user to visit an attacker-controlled page. The attacker constructs a page that loads the Backoffice URL inside a frame styled with opacity or positioning tricks. The user interacts with what appears to be attacker content but actually clicks controls within the framed Backoffice session, executing privileged actions under the user's authenticated context. See the SAP Note #3559510 and SAP Security Patch Day for vendor guidance.

Detection Methods for CVE-2025-24874

Indicators of Compromise

Backoffice sessions showing unexpected administrative actions performed shortly after a user visited an external site
Web server or reverse proxy logs missing a Content-Security-Policy: frame-ancestors response header on Backoffice responses
Referer headers on Backoffice state-changing requests pointing to untrusted third-party origins

Detection Strategies

Inspect HTTP responses from Backoffice endpoints and confirm whether both X-FRAME-OPTIONS and a CSP frame-ancestors directive are present
Correlate administrator browsing activity with subsequent Backoffice configuration or data changes to identify potential UI redress attacks
Review browser telemetry for framed Backoffice sessions originating from unexpected parent origins

Monitoring Recommendations

Alert on Backoffice audit log entries showing sensitive changes without corresponding legitimate workflow context
Monitor egress traffic from administrator workstations for connections to newly registered or low-reputation domains preceding Backoffice actions
Track browser version rollouts in the enterprise fleet so security teams can react before X-FRAME-OPTIONS support is removed

How to Mitigate CVE-2025-24874

Immediate Actions Required

Apply the SAP-provided fix documented in SAP Note #3559510
Configure the reverse proxy or application server to emit a strict Content-Security-Policy: frame-ancestors 'self' header on all Backoffice responses
Restrict Backoffice access to trusted networks or VPN-connected administrators to reduce exposure to attacker-controlled pages
Educate administrators to avoid browsing untrusted sites in the same browser session used for Backoffice work

Patch Information

SAP addressed the issue through its SAP Security Patch Day process. Customers should review SAP Note #3559510 and the SAP Security Patch Day portal for the applicable patch level and installation instructions for their SAP Commerce release.

Workarounds

Add a web server or load balancer rule that injects Content-Security-Policy: frame-ancestors 'self' on every Backoffice response
Retain the existing X-FRAME-OPTIONS: SAMEORIGIN header as a defense-in-depth measure for older browsers
Enforce browser policies that disable third-party framing or require SameSite cookies to limit the scope of hijacked requests

bash

# Configuration example: enforce frame-ancestors on an Nginx reverse proxy fronting SAP Commerce Backoffice
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Content-Security-Policy "frame-ancestors 'self'" always;