CVE-2025-25243: SAP SRM Information Disclosure Flaw

CVE-2025-25243 Overview

CVE-2025-25243 is a Path Traversal vulnerability affecting SAP Supplier Relationship Management (Master Data Management Catalog). The flaw allows an unauthenticated attacker to exploit a publicly available servlet to download arbitrary files over the network without any user interaction. This vulnerability can lead to the exposure of highly sensitive information, though it does not impact system integrity or availability.

Critical Impact

Unauthenticated remote attackers can download arbitrary files from affected SAP SRM systems, potentially exposing configuration files, credentials, business data, and other sensitive information without any user interaction required.

Affected Products

• SAP Supplier Relationship Management (Master Data Management Catalog)
• SAP SRM MDM Catalog components with exposed servlets
• Systems accessible over the network without proper access controls

Discovery Timeline

• February 11, 2025 - CVE-2025-25243 published to NVD
• April 15, 2026 - Last updated in NVD database

Technical Details for CVE-2025-25243

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Path Traversal), also known as Directory Traversal. The flaw exists in a publicly accessible servlet within SAP Supplier Relationship Management's Master Data Management Catalog component. The servlet fails to properly validate or sanitize user-supplied input when processing file download requests, allowing attackers to manipulate file path parameters to access files outside the intended directory structure.

The network-based attack vector with no authentication requirements and no user interaction needed makes this vulnerability particularly dangerous for organizations with internet-exposed SAP SRM instances. The vulnerability has a changed scope, meaning successful exploitation can affect resources beyond the vulnerable component's security scope.

Root Cause

The root cause of CVE-2025-25243 is improper input validation within the servlet's file handling functionality. The application fails to properly sanitize path traversal sequences (such as ../ or encoded variants) in user-supplied input, allowing attackers to escape the intended file directory and access arbitrary files on the system. This lack of input validation is a common weakness that can be prevented through proper canonicalization and path validation routines.

Attack Vector

The attack is executed remotely over the network by sending specially crafted HTTP requests to the vulnerable servlet. An attacker constructs a request with manipulated file path parameters containing directory traversal sequences to navigate outside the web application's root directory. By systematically traversing the file system, attackers can download sensitive configuration files, database credentials, business documents, and other confidential data stored on the server.

The attack requires no authentication and no user interaction, making it trivial for attackers to exploit. Affected systems that are directly accessible from the internet are at highest risk, though internal attackers on the same network can also exploit this vulnerability.

Detection Methods for CVE-2025-25243

Indicators of Compromise

• HTTP request logs showing access to the vulnerable servlet with unusual path parameters containing ../ sequences or URL-encoded equivalents (%2e%2e%2f, %2e%2e/, ..%2f)
• Access logs indicating requests for sensitive files outside the web application directory such as /etc/passwd, configuration files, or SAP credential files
• Unusual patterns of file access requests from external IP addresses targeting SAP SRM endpoints
• Network traffic analysis revealing large data exfiltration from SAP SRM servers

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block path traversal patterns in HTTP requests targeting SAP SRM
• Configure SIEM alerts for suspicious access patterns to the MDM Catalog servlet, particularly requests containing encoded path traversal sequences
• Deploy network intrusion detection systems (IDS) with signatures for path traversal attacks against SAP systems
• Enable detailed access logging on SAP SRM servers and monitor for anomalous file access patterns

Monitoring Recommendations

• Enable verbose HTTP access logging on SAP SRM web servers to capture full request URIs and parameters
• Monitor egress traffic from SAP SRM systems for unusual data transfers or large file downloads to external destinations
• Implement file integrity monitoring (FIM) on sensitive configuration directories to detect unauthorized access attempts
• Review authentication logs for patterns indicating reconnaissance or enumeration activities against SAP services

How to Mitigate CVE-2025-25243

Immediate Actions Required

• Apply the security patch referenced in SAP Note #3567551 immediately on all affected SAP SRM systems
• Restrict network access to SAP SRM servers using firewall rules to limit exposure to trusted networks only
• Implement a web application firewall (WAF) with rules to block path traversal patterns until patching is complete
• Review server access logs for signs of exploitation prior to patch application

Patch Information

SAP has released a security patch to address this vulnerability as part of their Security Patch Day releases. Organizations should consult SAP Note #3567551 for detailed patch instructions and apply the fix according to SAP's guidance. Additional information about SAP security updates can be found on the SAP Security Patch Day portal.

Workarounds

• If immediate patching is not possible, consider temporarily disabling the affected MDM Catalog servlet until the fix can be applied
• Implement strict network segmentation to isolate SAP SRM systems from untrusted networks and the public internet
• Deploy WAF rules to filter and block requests containing path traversal patterns (../, %2e%2e%2f, and other encoded variants)
• Apply principle of least privilege to the service account running the SAP SRM application to minimize the impact of successful file access