CVE-2025-30010: SAP SRM CSRF Vulnerability

CVE-2025-30010 Overview

CVE-2025-30010 is an open redirect vulnerability [CWE-601] in the Live Auction Cockpit component of SAP Supplier Relationship Management (SRM). The affected SRM packages ship a deprecated Java applet component that fails to validate redirect targets. An unauthenticated attacker can craft a malicious link that, when clicked by a victim, redirects the browser to an attacker-controlled site. Successful exploitation produces a low impact on confidentiality and integrity, with no impact on availability. SAP addressed the issue in the May 2025 Security Patch Day release.

Critical Impact
Attackers can weaponize trusted SAP SRM URLs to redirect authenticated users to phishing or malware delivery sites, enabling credential theft and session hijacking scenarios.

Affected Products

SAP Supplier Relationship Management (SRM) version 7.14
Live Auction Cockpit component within affected SRM packages
Deployments using the deprecated Java applet interface

Discovery Timeline

2025-05-13 - CVE-2025-30010 published to NVD as part of SAP Security Patch Day
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30010

Vulnerability Analysis

The Live Auction Cockpit in SAP SRM relies on a deprecated Java applet component to render bidding sessions and manage auction workflows. The component accepts redirect parameters without validating that the destination URL points to a trusted host within the SAP application domain. An attacker constructs a URL pointing to a legitimate SRM endpoint but includes a redirect parameter referencing an attacker-controlled domain. When a victim clicks the crafted link, the SRM server processes the request and issues a browser redirect to the untrusted destination.

Because the initial URL originates from a trusted SAP host, victims and security controls perceive the link as legitimate. Attackers use this trust relationship to deliver phishing pages that mimic SAP login flows or to serve malware payloads. The Common Weakness Enumeration classifies this issue as [CWE-601] URL Redirection to Untrusted Site.

Root Cause

The root cause is missing validation of user-supplied redirect targets in the deprecated Java applet handler. The component processes redirect parameters without enforcing an allowlist of trusted destinations or verifying that URLs remain within the SRM application origin. Reliance on a deprecated applet framework also means the code has not received modern URL validation hardening.

Attack Vector

Exploitation requires user interaction. The attacker distributes the malicious link through email, chat, or a compromised website. Authentication is not required to craft the link, though the value of the attack increases when the victim holds an active SRM session. Upon click, the browser follows the redirect chain from the SAP host to the attacker's site, where credential harvesting, session token capture, or drive-by download payloads execute.

No verified public proof-of-concept code is available. The vulnerability manifests in the redirect parameter handling of the Live Auction Cockpit applet. See the SAP Note #3578900 for technical details.

Detection Methods for CVE-2025-30010

Indicators of Compromise

Outbound HTTP 302 responses from SRM Live Auction Cockpit endpoints referencing external, non-corporate domains in the Location header
Web proxy logs showing user navigation from SAP SRM URLs to unfamiliar external hosts within the same session
Phishing landing pages that mimic SAP SRM or SAP GUI login prompts referenced by SRM-originated referrers

Detection Strategies

Inspect SAP SRM web server logs for requests containing suspicious redirect or URL parameters targeting the Live Auction Cockpit applet paths
Correlate user click events on SRM URLs with subsequent DNS resolutions to newly registered or low-reputation domains
Deploy web application firewall (WAF) rules that flag redirect parameters pointing to hosts outside the approved SAP domain list

Monitoring Recommendations

Enable full URL logging on reverse proxies fronting SAP SRM to capture query strings and redirect targets
Monitor email security gateways for inbound messages containing links to SRM hosts with embedded redirect parameters
Track user reports of unexpected redirects from SAP applications and correlate with authentication anomalies in Active Directory or SAP identity stores

How to Mitigate CVE-2025-30010

Immediate Actions Required

Apply the fix documented in SAP Note #3578900 to affected SRM 7.14 systems
Review the May 2025 SAP Security Patch Day Update for related advisories
Audit user access to the Live Auction Cockpit and disable the deprecated Java applet interface where feasible

Patch Information

SAP released the corrective patch as part of the May 2025 Security Patch Day. Administrators must download and apply SAP Note #3578900 to remediate the open redirect in the Live Auction Cockpit. The patch introduces validation of redirect destinations within the affected applet component. Verify installation by reviewing the SAP support portal for confirmation of applied notes on each SRM 7.14 instance.

Workarounds

Restrict network access to the Live Auction Cockpit endpoint to trusted internal networks pending patch deployment
Implement a WAF rule that strips or rejects external URLs supplied to SRM redirect parameters
Educate SRM users to inspect the browser address bar after clicking links and to report unexpected external redirects

bash

# Example WAF rule to block external redirects in SRM applet parameters
# (ModSecurity syntax)
SecRule ARGS:redirect "!@rx ^https?://([a-z0-9-]+\.)*yourdomain\.com/" \
    "id:1030010,phase:2,deny,status:403,\
    msg:'CVE-2025-30010 - Blocked external redirect in SAP SRM Live Auction Cockpit'"