CVE-2025-42893: SAP Business Connector Redirect Vulnerability

CVE-2025-42893 Overview

CVE-2025-42893 is an Open Redirect vulnerability [CWE-601] in SAP Business Connector. An unauthenticated attacker can craft a malicious URL that, when opened by a victim, redirects the browser to an attacker-controlled site rendered inside an embedded frame. Successful exploitation allows the attacker to steal sensitive information and perform unauthorized actions in the context of the victim's web session. The flaw affects the confidentiality and integrity of web client data but does not impact system availability.

Critical Impact
Attackers can weaponize trusted SAP Business Connector URLs to redirect users to malicious content, enabling credential theft, phishing, and unauthorized actions against confidentiality and integrity of web client data.

Affected Products

SAP Business Connector 4.8

Discovery Timeline

2025-11-11 - CVE-2025-42893 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-42893

Vulnerability Analysis

CVE-2025-42893 is classified under [CWE-601] URL Redirection to Untrusted Site (Open Redirect). The vulnerability exists in SAP Business Connector 4.8, a component used to integrate SAP systems with non-SAP applications over the internet. The application accepts user-controlled input in a redirect parameter without validating that the destination remains within a trusted origin. An unauthenticated attacker can craft a URL pointing to the legitimate SAP Business Connector host that ultimately loads attacker-controlled content within an embedded frame.

Root Cause

The root cause is insufficient validation of a redirect target parameter processed by SAP Business Connector. The application trusts client-supplied destination values and does not enforce an allow-list of permitted domains. Because the redirect renders the target site inside a frame, victims see the trusted SAP Business Connector hostname in the address bar while interacting with attacker-controlled HTML.

Attack Vector

Exploitation requires user interaction. The attacker distributes the crafted URL through phishing email, chat, or a compromised website. When the victim clicks the link, the browser loads the SAP Business Connector endpoint, which then embeds the attacker's page in a frame. The attacker can then present fake login forms, harvest session material available to the framed content, or trick the user into invoking actions that leverage their authenticated context. No credentials are required to build or deliver the malicious link.

Because no verified proof-of-concept is publicly available, refer to SAP Note #3662000 for vendor technical details.

Detection Methods for CVE-2025-42893

Indicators of Compromise

Web server access logs showing outbound redirect responses from SAP Business Connector endpoints to external, non-corporate domains.
Referer headers on user endpoints originating from SAP Business Connector URLs but loading unrelated third-party domains inside frames.
Phishing emails containing links to legitimate SAP Business Connector hostnames with unusual query string parameters encoding external URLs.

Detection Strategies

Inspect HTTP responses from SAP Business Connector for Location headers or client-side redirects pointing to domains outside the organization's allow-list.
Alert on requests containing redirect parameters (for example url=, next=, redirect=, target=) whose values decode to external hostnames.
Correlate user click-through events on SAP Business Connector URLs with subsequent navigation to newly registered or low-reputation domains.

Monitoring Recommendations

Enable verbose HTTP request and response logging on SAP Business Connector and forward logs to a centralized analytics platform for query and retention.
Monitor email gateways for inbound messages containing links to SAP Business Connector hostnames combined with URL-encoded external destinations.
Track user reports of unexpected login prompts or content rendered under trusted SAP Business Connector domains.

How to Mitigate CVE-2025-42893

Immediate Actions Required

Apply the SAP security patch referenced in SAP Note #3662000 on all SAP Business Connector 4.8 instances.
Review the November 2025 SAP Security Patch Day bulletin and prioritize remediation across exposed systems.
Restrict inbound access to SAP Business Connector to trusted networks until patching is complete.

Patch Information

SAP has released a fix documented in SAP Note #3662000. Administrators must authenticate to the SAP support portal to obtain the patched build and installation instructions. Consult the vendor advisory published through SAP Security Patch Day for the corresponding release notes.

Workarounds

Deploy a reverse proxy or web application firewall rule that blocks requests to SAP Business Connector containing redirect parameters resolving to external domains.
Enforce a strict Content-Security-Policy with frame-ancestors 'self' and a frame-src allow-list to prevent untrusted content from being embedded.
Train users to verify the final destination of links and to report unexpected login prompts appearing under SAP Business Connector URLs.

bash

# Example nginx rule blocking external redirect targets in SAP Business Connector URLs
location /invoke/ {
    if ($arg_url ~* "^https?://(?!bc\.internal\.example\.com)") {
        return 403;
    }
    proxy_pass http://sap-business-connector-backend;
}