CVE-2025-25242: SAP NetWeaver ABAP XSS Vulnerability

CVE-2025-25242 Overview

CVE-2025-25242 is a Cross-Site Scripting (XSS) vulnerability affecting SAP NetWeaver Application Server ABAP. The flaw allows an unauthenticated attacker to inject and execute malicious scripts within the context of a targeted user's browser session. Exploitation requires user interaction, such as clicking a crafted link. Successful attacks can result in limited disclosure of session data and limited modification of content rendered to the user. Availability of the application is not affected. The issue is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Attackers can execute arbitrary scripts in the browsers of authenticated SAP NetWeaver users, enabling session data theft and content manipulation across a changed security scope.

Affected Products

SAP NetWeaver Application Server ABAP
SAP business applications running on affected NetWeaver ABAP releases
Any SAP Web Dynpro or ABAP-generated web content served by vulnerable versions

Discovery Timeline

2025-03-11 - CVE-2025-25242 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-25242

Vulnerability Analysis

CVE-2025-25242 is a reflected or stored Cross-Site Scripting flaw in SAP NetWeaver Application Server ABAP. The server accepts user-controlled input and includes it in HTTP responses without sufficient output encoding. When a victim renders the response, the browser interprets the injected payload as executable script within the SAP application origin.

Because the CVSS scope is changed, the injected script can influence resources outside the initially vulnerable component. That includes iframes, subdomains, or embedded SAP portals sharing trust with the vulnerable server. The attacker leverages the victim's authenticated session to read data or perform actions the user is authorized to execute.

The impact on confidentiality and integrity is limited, and availability is unaffected. Typical outcomes include theft of session identifiers, capture of form input, redirection to attacker-controlled pages, and defacement of rendered content within SAP web interfaces.

Root Cause

The root cause is improper neutralization of user-supplied input during web page generation, classified under CWE-79. One or more request parameters processed by NetWeaver ABAP web components are reflected into HTML output without context-aware escaping. SAP has not publicly documented the specific parameter or handler in the CVE record; refer to SAP Note #3562390 for authoritative technical details.

Attack Vector

The attack is delivered over the network and requires user interaction. An attacker crafts a URL containing a malicious script payload and delivers it through phishing, chat, or a compromised site. When an authenticated SAP user follows the link, the vulnerable NetWeaver endpoint reflects the payload into the response, and the browser executes it under the SAP application's origin. The attacker does not require credentials to weaponize the payload, but the victim must have an active SAP session for the impact to be meaningful.

No verified public proof-of-concept code is available. Technical details are described in prose only; consult the SAP Security Patch Day advisory for vendor-provided guidance.

Detection Methods for CVE-2025-25242

Indicators of Compromise

HTTP request logs containing script tags, javascript: URIs, event handler attributes such as onerror= or onload=, or encoded variants (%3Cscript%3E) in query strings or POST bodies directed at NetWeaver ABAP endpoints.
Unexpected outbound browser requests from SAP web sessions to unknown domains, suggesting data exfiltration by injected scripts.
SAP application logs showing anomalous request parameters that echo back into rendered pages.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect requests to SAP NetWeaver ABAP endpoints for XSS payload patterns and encoded HTML entities.
Correlate SAP HTTP access logs with endpoint telemetry to identify users who followed suspicious links immediately before anomalous session activity.
Enable Content Security Policy (CSP) reporting on SAP portals to surface script execution violations that indicate attempted or successful injection.

Monitoring Recommendations

Continuously monitor SAP application server access logs for reflected input patterns and cross-reference with user session identifiers.
Alert on SAP administrator or privileged user sessions that originate from URLs containing unusual query string content.
Track browser telemetry for unexpected DOM modifications or script execution within SAP web interfaces using existing endpoint identification tooling.

How to Mitigate CVE-2025-25242

Immediate Actions Required

Apply the SAP-provided patch referenced in SAP Note #3562390 to all affected NetWeaver Application Server ABAP systems.
Inventory internet-exposed SAP NetWeaver ABAP endpoints and prioritize patching public-facing instances first.
Review recent SAP web access logs for indicators of exploitation attempts against the affected handlers.

Patch Information

SAP released the fix as part of its monthly Security Patch Day. Administrators should download and apply the correction instructions in SAP Note #3562390 and validate deployment against the SAP Security Patch Day portal. Confirm the patch level in transaction SPAM or via the System Recommendations application in SAP Solution Manager.

Workarounds

Restrict access to SAP NetWeaver ABAP web interfaces to trusted networks using reverse proxies or SAP Web Dispatcher access rules until patches are deployed.
Enforce strict Content Security Policy headers on SAP web endpoints to limit inline script execution and constrain script sources.
Train SAP users to avoid clicking unsolicited links that reference SAP hostnames, since exploitation requires user interaction.

bash

# Example: enforce Content-Security-Policy at the SAP Web Dispatcher
# icm/HTTP/mod_0 = PREFIX=/, FILE=$(DIR_PROFILE)/modification.txt
# modification.txt entry:
if %{REQUEST_METHOD} = GET
  SetResponseHeader Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'self'"
end