CVE-2025-42884: SAP NetWeaver JNDI Injection Vulnerability

CVE-2025-42884 Overview

CVE-2025-42884 affects SAP NetWeaver Enterprise Portal and permits unauthenticated attackers to inject Java Naming and Directory Interface (JNDI) environment properties or supply a URL used during JNDI lookup operations. An attacker can redirect lookup requests to an attacker-controlled JNDI provider. This exposes server information and permits modification of data returned during the lookup. Availability is not impacted.

The weakness is categorized under [CWE-943] Improper Neutralization of Special Elements in Data Query Logic. Because exploitation requires no privileges and no user interaction over the network, the flaw is reachable directly from remote clients that can contact the Enterprise Portal.

Critical Impact
Unauthenticated remote attackers can redirect JNDI lookups to a malicious provider, leading to disclosure and modification of server information on affected SAP NetWeaver Enterprise Portal deployments.

Affected Products

SAP NetWeaver Enterprise Portal
SAP NetWeaver Application Server Java components performing JNDI lookups
SAP customer deployments referenced in SAP Note #3660969

Discovery Timeline

2025-11-11 - CVE-2025-42884 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-42884

Vulnerability Analysis

SAP NetWeaver Enterprise Portal performs JNDI lookups using inputs that are not fully validated. An unauthenticated attacker can supply values that influence either the JNDI environment properties or the lookup URL itself. The service then contacts an unintended naming or directory provider chosen by the attacker.

JNDI is a Java API that exposes naming and directory services such as LDAP, RMI, DNS, and CORBA. When an application accepts attacker-controlled data into Context.PROVIDER_URL or into a Context.lookup() argument, that application effectively delegates a portion of its trust boundary to the caller. The result of the lookup then re-enters application logic, which can influence subsequent decisions or leak metadata about the runtime environment.

The Enterprise Portal is designed to be network-facing, so attackers can reach the vulnerable endpoint without needing an authenticated session. Confidentiality and integrity of information handled during the lookup are affected, while service availability remains intact.

Root Cause

The root cause is improper neutralization of special elements in data query logic ([CWE-943]). The affected code paths accept externally supplied strings and use them to construct JNDI parameters without enforcing an allowlist of trusted providers or validating the scheme and host of the target URL.

Attack Vector

Exploitation occurs over the network. The attacker sends a crafted request to an Enterprise Portal endpoint that triggers a server-side JNDI operation. By injecting a provider URL such as ldap://attacker.example/obj or by seeding environment properties, the attacker forces the server to open a connection to their own directory service. The malicious service returns crafted records that either expose server-side data in error handling or modify information consumed by the portal.

Because no verified public proof of concept has been published, technical exploitation details should be sourced from the SAP Security Patch Day Update and the referenced SAP Note.

Detection Methods for CVE-2025-42884

Indicators of Compromise

Outbound LDAP, RMI, or DNS connections initiated by SAP NetWeaver Java processes to hosts outside the approved directory inventory.
HTTP requests to Enterprise Portal endpoints containing parameters that resemble JNDI URLs, for example values beginning with ldap://, ldaps://, rmi://, or iiop://.
Java stack traces in NetWeaver logs referencing javax.naming.InitialContext or Context.lookup triggered from portal request handlers.

Detection Strategies

Inspect NetWeaver Java defaultTrace and HTTP access logs for request parameters containing JNDI-style URIs or property names such as java.naming.provider.url.
Monitor the SAP host for unexpected egress traffic on ports 389, 636, 1099, and 1389, especially to Internet destinations.
Correlate authentication-less HTTP requests to portal endpoints with subsequent outbound directory service connections from the same JVM.

Monitoring Recommendations

Forward SAP NetWeaver logs and host network telemetry into a centralized analytics platform for behavioral correlation.
Alert on any new outbound destination contacted by the NetWeaver Java process that is not part of the documented directory infrastructure.
Track process-to-network relationships on SAP hosts so lookups originating from portal request threads are visible to responders.

How to Mitigate CVE-2025-42884

Immediate Actions Required

Apply the fix described in SAP Note #3660969 on all SAP NetWeaver Enterprise Portal instances.
Restrict inbound access to the Enterprise Portal to trusted networks until the patch is deployed.
Enforce strict egress filtering from SAP application servers so the NetWeaver JVM cannot reach untrusted LDAP, RMI, or DNS providers on the Internet.

Patch Information

SAP has released a corrective note through the SAP Security Patch Day process. Refer to SAP Note #3660969 for exact support package levels, kernel patches, and manual configuration steps. Administrators should validate patch deployment using the SAP Security Patch Day tooling documented at SAP Security Patch Day Update.

Workarounds

Place the Enterprise Portal behind a reverse proxy or web application firewall that blocks request parameters containing ldap://, rmi://, iiop://, or dns: schemes.
Configure host-based firewalls on SAP application servers to permit outbound directory traffic only to approved corporate directory endpoints.
Where feasible, disable or gate the Enterprise Portal features identified in the SAP Note as invoking JNDI lookups until the patch can be applied.

bash

# Example egress restriction: allow LDAP only to the corporate directory
iptables -A OUTPUT -p tcp -d 10.10.20.5 --dport 636 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 389 -j DROP
iptables -A OUTPUT -p tcp --dport 636 -j DROP
iptables -A OUTPUT -p tcp --dport 1099 -j DROP
iptables -A OUTPUT -p tcp --dport 1389 -j DROP