CVE-2025-24875: SAP Commerce CSRF Vulnerability

CVE-2025-24875 Overview

CVE-2025-24875 affects SAP Commerce, which by default sets certain cookies with the SameSite attribute configured to None. This configuration applies to authentication cookies used in the SAP Commerce Backoffice. The weakness reduces defense in depth against Cross-Site Request Forgery (CSRF) attacks and introduces future browser compatibility risks. The issue is tracked under [CWE-352] Cross-Site Request Forgery.

Critical Impact
An attacker who successfully lures an authenticated Backoffice user to a malicious site can leverage cross-origin requests to impact confidentiality and integrity of Backoffice data.

Affected Products

SAP Commerce (Backoffice component)
Deployments using the default cookie SameSite=None configuration
Environments relying on browser-based authentication cookies without explicit hardening

Discovery Timeline

2025-02-11 - CVE-2025-24875 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24875

Vulnerability Analysis

SAP Commerce ships with authentication and session cookies flagged SameSite=None. Browsers send these cookies on cross-site requests when the Secure attribute is also present. The behavior removes a browser-enforced layer that normally blocks CSRF requests originating from unrelated origins.

The vulnerability weakens defense in depth rather than granting direct code execution. Exploitation requires user interaction and specific conditions, which raises attack complexity. Successful abuse can still compromise confidentiality and integrity of Backoffice sessions, because the Backoffice handles privileged administrative functions.

For authoritative remediation guidance, refer to the SAP Note #3555364 and the SAP Security Patch Day Announcement.

Root Cause

The root cause is an insecure default configuration [CWE-352]. Setting SameSite=None on authentication cookies opts the application out of the browser's default cross-site cookie protections. Modern browsers use SameSite=Lax as the default when the attribute is missing, so explicitly setting None is a deliberate downgrade.

Attack Vector

An attacker crafts a malicious page that triggers a cross-origin request to a Backoffice endpoint. If a victim with an active Backoffice session visits the page, the browser attaches the SameSite=None cookies to the request. The attacker can then piggyback on the authenticated session to invoke Backoffice actions or read sensitive responses, subject to other CSRF mitigations in place.

The CWE-352 pattern requires the target application to lack additional CSRF token validation or origin checks for the affected endpoints. Attack complexity is high because the attacker must chain user interaction with a viable cross-origin request path.

Detection Methods for CVE-2025-24875

Indicators of Compromise

Unexpected state-changing requests to Backoffice endpoints containing Referer or Origin headers pointing to untrusted domains.
HTTP responses to Backoffice actions correlated with sessions that never navigated directly to the Backoffice UI.
Anomalous administrative changes performed during user browsing sessions on unrelated sites.

Detection Strategies

Inspect Set-Cookie headers from SAP Commerce responses for SameSite=None on session or authentication cookies and flag deviations from hardened configuration baselines.
Correlate Backoffice audit logs with web proxy telemetry to identify administrative actions preceded by cross-origin referrers.
Deploy web application firewall (WAF) rules that alert on Backoffice POST requests missing valid CSRF tokens or with mismatched Origin headers.

Monitoring Recommendations

Enable verbose access logging on Backoffice endpoints and forward logs to a centralized analytics platform.
Monitor for spikes in failed CSRF token validations, which can indicate probing.
Track administrator session activity for concurrent use across unusual geolocations or user agents.

How to Mitigate CVE-2025-24875

Immediate Actions Required

Apply the fixes referenced in SAP Note #3555364 as delivered through SAP Security Patch Day.
Reconfigure Backoffice authentication cookies to use SameSite=Lax or SameSite=Strict where compatible.
Enforce CSRF token validation on all state-changing Backoffice endpoints.
Restrict Backoffice access to trusted networks or VPN-only reachability.

Patch Information

SAP has published remediation through the SAP Security Patch Day process. Administrators should authenticate to the SAP Support Portal and apply SAP Note #3555364. Consult the SAP Security Patch Day Announcement for the release schedule and cumulative advisories.

Workarounds

Override the default cookie policy in SAP Commerce configuration to set SameSite=Lax on authentication cookies until the patch is applied.
Add server-side Origin and Referer header validation for Backoffice endpoints as a compensating control.
Require administrators to use dedicated browsers or isolated browsing profiles for Backoffice work to limit cross-site exposure.
Shorten Backoffice session lifetimes to reduce the window for CSRF exploitation.

bash

# Configuration example: enforce SameSite=Lax on Backoffice cookies
# Refer to SAP Note #3555364 for the authoritative property names and values
# Example illustrative property update in local.properties
backoffice.cookie.samesite=Lax
backoffice.cookie.secure=true
backoffice.cookie.httponly=true