CVE-2025-31326: SAP BusinessObjects XSS Vulnerability

CVE-2025-31326 Overview

CVE-2025-31326 is an HTML Injection vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence). An authenticated attacker with basic user privileges can inject malicious HTML into specific input fields. Successful exploitation enables unintended redirects and manipulation of application behavior, including redirection to attacker-controlled domains. The flaw affects the integrity of the system, while confidentiality and availability remain unaffected. The issue is classified under CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page).

Critical Impact
Authenticated attackers can inject HTML into Web Intelligence input fields to redirect users to attacker-controlled domains and manipulate application behavior.

Affected Products

SAP BusinessObjects Business Intelligence Platform
Web Intelligence component within the BI Platform
Refer to SAP Note #3573199 for the affected version list

Discovery Timeline

2025-07-08 - CVE-2025-31326 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-31326

Vulnerability Analysis

The vulnerability exists in the Web Intelligence module of the SAP BusinessObjects Business Intelligence Platform. Specific input fields fail to neutralize HTML markup submitted by authenticated users. When the application later renders that content, injected tags execute in the browser context of other users.

HTML Injection differs from full Cross-Site Scripting because the payload primarily leverages HTML tags rather than script execution. Attackers can still craft <a>, <iframe>, <meta>, or <form> elements that redirect victims, alter rendered layouts, or capture submitted data through overlaid forms. The impact is limited to integrity, as attackers cannot directly read confidential BI data or disrupt availability of the platform.

Exploitation requires network access, low privileges, and user interaction, meaning a victim must load or view the affected report or field. The scope is changed because injected content executes in a different security context than the vulnerable component.

Root Cause

The root cause is improper neutralization of HTML tags in user-controlled input fields within Web Intelligence. Input passed to specific fields is stored and later rendered without sufficient output encoding, allowing raw HTML to reach the DOM.

Attack Vector

An attacker authenticates with basic user credentials and submits crafted HTML payloads to a vulnerable Web Intelligence input field. When another user views the report or object containing the payload, their browser renders the injected markup. Typical payloads include redirect anchors, hidden iframes pointing to phishing pages, or meta-refresh tags that navigate the victim to an attacker-controlled domain.

The vulnerability mechanism is described in prose only. See SAP Note #3573199 for vendor-specific technical details.

Detection Methods for CVE-2025-31326

Indicators of Compromise

Web Intelligence report fields containing HTML tags such as <iframe>, <meta http-equiv="refresh">, <a href> pointing to unexpected external domains, or <form action> attributes.
Outbound HTTP requests from user browsers to domains not associated with the SAP deployment shortly after opening a BI report.
Audit log entries showing basic-privilege users modifying report objects or input parameters at unusual frequencies.

Detection Strategies

Scan stored Web Intelligence content and document metadata for embedded HTML markup that should not be present in business report fields.
Deploy web application firewall rules that inspect POST parameters to Web Intelligence endpoints for HTML tag patterns.
Correlate BI Platform audit logs with proxy or DNS telemetry to identify redirects originating from BI report sessions.

Monitoring Recommendations

Monitor changes to Web Intelligence documents made by low-privilege accounts and alert on anomalous edit volumes.
Track browser navigation events from users viewing BI reports to detect redirects to newly registered or uncategorized domains.
Review SAP BusinessObjects access logs for repeated failed and successful edits to the same report from the same user session.

How to Mitigate CVE-2025-31326

Immediate Actions Required

Apply the SAP-provided fix documented in SAP Note #3573199 as part of the July 2025 SAP Security Patch Day cycle.
Audit existing Web Intelligence reports and stored objects for embedded HTML payloads and remove any suspicious content.
Restrict Web Intelligence authoring privileges to users who require them and remove unnecessary edit rights from general accounts.

Patch Information

SAP addressed CVE-2025-31326 in the July 2025 Security Patch Day release. Administrators should consult SAP Note #3573199 for the list of fixed support package levels and installation instructions. Additional advisories are available on the SAP Security Patch Day portal.

Workarounds

Enforce strict input validation at the web tier using a WAF policy that blocks HTML tags in Web Intelligence input parameters until the patch is deployed.
Configure Content Security Policy headers on the BI Platform web front end to restrict frame sources and script execution.
Educate BI users to report unexpected redirects when opening reports and to avoid entering credentials into pages launched from BI content.

bash

# Example WAF rule (illustrative) to block HTML tags in Web Intelligence input
SecRule ARGS "@rx <(iframe|script|meta|form|a\s)" \
  "id:1003126,phase:2,deny,status:403,log,msg:'Possible HTML injection in Web Intelligence input (CVE-2025-31326)'"