CVE-2025-30009 Overview
CVE-2025-30009 is a Cross-Site Scripting (XSS) vulnerability in the Live Auction Cockpit component of SAP Supplier Relationship Management (SRM). The affected SRM packages ship a deprecated Java applet component that fails to sanitize user-controlled input. An unauthenticated attacker can craft a malicious link that, when opened by a victim, executes arbitrary script in the victim's browser context. The flaw is classified under [CWE-79] and affects SAP SRM version 7.14. Exploitation requires user interaction but no privileges, and the scope changes because scripts execute in the trusted SAP application context.
Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in a victim's browser, enabling session data theft, unauthorized actions in SAP SRM, and phishing pivots against procurement users.
Affected Products
- SAP Supplier Relationship Management 7.14
- Live Auction Cockpit component within affected SRM packages
- Deployments relying on the deprecated Java applet in SRM
Discovery Timeline
- 2025-05-13 - CVE-2025-30009 published to NVD
- 2025-05-13 - SAP releases security patch via SAP Note #3578900 on SAP Security Patch Day
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-30009
Vulnerability Analysis
The Live Auction Cockpit in SAP SRM renders content through a deprecated Java applet component that does not properly encode or validate input before returning it in browser-rendered responses. Because the injected payload executes within the SAP application's origin, an attacker can read session cookies accessible to script, invoke authenticated actions on behalf of the victim, and manipulate rendered auction data. The vulnerability requires user interaction, typically a victim clicking a crafted URL or visiting an attacker-controlled page that triggers a request to the vulnerable endpoint. Confidentiality and integrity impact are limited to the scope of the victim's browser session, and application availability is not affected.
Root Cause
The root cause is missing output encoding in a deprecated Java applet component bundled with SRM 7.14. User-supplied parameters processed by the Live Auction Cockpit are reflected into HTML responses without contextual escaping, satisfying the classic reflected XSS pattern described by [CWE-79]. Reliance on a deprecated applet compounds the issue because modern browsers no longer sandbox applet content, and secure input handling was never retrofitted into the legacy code path.
Attack Vector
Exploitation is network-based and unauthenticated. An attacker crafts a URL pointing to the vulnerable Live Auction Cockpit endpoint with a malicious script payload in a reflected parameter. The attacker delivers the link through phishing email, chat, or a malicious web page. When an authenticated SRM user opens the link, the payload executes in their browser under the SAP application origin. The attacker can then exfiltrate session identifiers, forge procurement actions, or stage further social engineering. See the SAP Note #3578900 advisory for vendor technical details.
Detection Methods for CVE-2025-30009
Indicators of Compromise
- Inbound HTTP requests to Live Auction Cockpit URLs containing <script>, javascript:, onerror=, or URL-encoded equivalents in query parameters
- Outbound browser requests from SRM users to unfamiliar domains immediately following access to auction URLs
- Unexpected DOM modifications or JavaScript execution originating from the SAP SRM application origin in browser telemetry
- Reports of unusual auction activity or session anomalies from procurement users
Detection Strategies
- Deploy web application firewall rules that inspect query strings and POST bodies to Live Auction Cockpit endpoints for script injection patterns
- Correlate SAP application logs with proxy logs to identify referer chains that funnel users through crafted external links
- Hunt for anomalous JavaScript execution in browser isolation or endpoint telemetry when users access /webdynpro or auction-related SRM paths
Monitoring Recommendations
- Monitor SAP SRM web server access logs for parameter values containing HTML or JavaScript metacharacters
- Alert on repeated 200 responses to Live Auction Cockpit URLs with abnormally long or encoded query strings
- Track user reports of unexpected browser prompts, redirects, or credential requests originating from SRM sessions
How to Mitigate CVE-2025-30009
Immediate Actions Required
- Apply the fix documented in SAP Note #3578900 to all SAP SRM 7.14 systems
- Inventory SRM deployments to confirm whether the Live Auction Cockpit and its Java applet component are enabled
- Instruct procurement users to avoid clicking SRM links received through untrusted channels until patching completes
Patch Information
SAP addressed CVE-2025-30009 as part of the May 2025 SAP Security Patch Day. Administrators should download and apply the correction instructions from SAP Note #3578900 and review the SAP Security Patch Day Notification for related fixes. After patching, verify the Live Auction Cockpit no longer reflects unescaped input by reviewing the vendor validation steps.
Workarounds
- Disable the Live Auction Cockpit component if it is not used in production procurement workflows
- Restrict network access to the SRM Live Auction Cockpit endpoints to trusted internal networks and VPN users
- Enforce Content Security Policy headers at the reverse proxy to limit inline script execution against SRM responses
- Deploy WAF signatures that block reflected XSS payloads targeting SRM URL parameters
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
