CVE-2025-42902 Overview
CVE-2025-42902 is a memory corruption vulnerability affecting SAP NetWeaver Application Server ABAP and the ABAP Platform. An unauthenticated remote attacker can send a corrupted SAP Logon Ticket or SAP Assertion Ticket to the application server. Parsing the malformed ticket triggers a null pointer dereference [CWE-476], causing the ABAP work process to crash.
The flaw has no impact on confidentiality or integrity but degrades availability of the targeted work process. SAP addressed the issue in an advisory released on SAP Security Patch Day.
Critical Impact
Unauthenticated attackers can crash SAP NetWeaver ABAP work processes over the network by submitting malformed authentication tickets, degrading service availability.
Affected Products
- SAP NetWeaver Application Server ABAP
- SAP ABAP Platform
- Systems accepting SAP Logon Tickets or SAP Assertion Tickets for authentication
Discovery Timeline
- 2025-10-14 - CVE-2025-42902 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-42902
Vulnerability Analysis
The vulnerability resides in the code path that parses SAP Logon Tickets and SAP Assertion Tickets on the ABAP application server. These tickets are cookie-based tokens used for single sign-on across SAP systems. When the server receives a ticket, it decodes and validates the structure before extracting authentication fields.
A crafted, corrupted ticket causes the parsing routine to reach a pointer that was never initialized or was set to NULL after a prior validation failure. The subsequent dereference terminates the ABAP work process handling the request. Because the ticket is presented at the pre-authentication stage, no valid credentials are required to reach the vulnerable code.
Repeated requests can consume multiple work processes on the target instance, producing a broader denial-of-service condition on the SAP dispatcher queue. Confidentiality and integrity are not affected because the crash occurs before any authenticated context is established.
Root Cause
The root cause is a missing null check on a pointer produced during ticket structure parsing. The ticket parser assumes that specific fields are present after passing initial length checks. When a malformed ticket omits or malforms these fields, the parser proceeds with a NULL value and dereferences it, matching the [CWE-476] pattern.
Attack Vector
Exploitation requires network access to any HTTP or HTTPS endpoint on the SAP NetWeaver AS ABAP instance that accepts logon tickets, such as the ICF, Web Dynpro, or SAP GUI for HTML entry points. The attacker submits an HTTP request containing a crafted MYSAPSSO2 cookie or an assertion ticket header value. No user interaction and no prior authentication are needed. The Exploit Prediction Scoring System (EPSS) reports this issue at 0.361%.
The vulnerability manifests in the ticket parsing routine of the ABAP kernel. Refer to SAP Note #3627308 for the detailed technical description available to licensed customers.
Detection Methods for CVE-2025-42902
Indicators of Compromise
- ABAP work process termination entries in the dev_w* developer traces referencing null pointer or segmentation faults during ticket handling
- Unexpected SIGSEGV core dumps generated by disp+work processes under /usr/sap/<SID>/<instance>/work/
- Bursts of HTTP requests carrying malformed MYSAPSSO2 cookies from a single source in ICM access logs
Detection Strategies
- Parse SAP ICM (Internet Communication Manager) access logs for repeated requests containing non-standard or truncated MYSAPSSO2 cookie values
- Alert on SM21 system log entries reporting work process restarts correlated with pre-authentication HTTP traffic
- Monitor process supervision data for elevated restart rates of disp+work on NetWeaver ABAP hosts
Monitoring Recommendations
- Forward SAP security audit log (SM19/SM20) and ICM logs to a centralized log platform with retention sufficient for incident review
- Track the count of dumped work processes per hour and alert on deviations from baseline
- Correlate source IPs generating malformed ticket requests against known-good SSO identity provider addresses
How to Mitigate CVE-2025-42902
Immediate Actions Required
- Apply the SAP kernel and ABAP Platform patches referenced in SAP Note #3627308
- Restrict network exposure of NetWeaver ABAP HTTP endpoints to trusted networks and SSO providers only
- Review ICM configuration to disable unused services that accept logon or assertion tickets
Patch Information
SAP released the fix as part of SAP Security Patch Day. Administrators should consult SAP Note #3627308 and the SAP Security Patch Day page for the exact patch levels applicable to their NetWeaver AS ABAP and ABAP Platform release. Apply the recommended kernel patch and ABAP support package to all production and non-production systems.
Workarounds
- Place a reverse proxy or Web Application Firewall in front of the SAP application server to inspect and drop malformed MYSAPSSO2 cookies
- Limit inbound HTTP/HTTPS access to the SAP instance using network ACLs where SSO ticket acceptance is not required externally
- Increase monitoring of work process restarts to detect exploitation attempts until the patch is applied
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
