CVE-2025-42908: SAP NetWeaver ABAP CSRF Vulnerability

CVE-2025-42908 Overview

CVE-2025-42908 is a Cross-Site Request Forgery (CSRF) vulnerability in SAP NetWeaver Application Server for ABAP. An authenticated attacker can initiate transactions directly through the session manager. This bypasses the first transaction screen and the associated authorization check.

Successful exploitation allows the attacker to execute transactions that normally require specific permissions. The flaw compromises the integrity and confidentiality of the affected SAP system by enabling unauthorized access to restricted functionality. Availability is not impacted.

The weakness is tracked as [CWE-352] Cross-Site Request Forgery. SAP addressed the issue in Security Note #3642021.

Critical Impact
Authenticated users can trigger privileged ABAP transactions without passing the standard authorization check, breaking the SAP permissions model.

Affected Products

SAP NetWeaver Application Server for ABAP
Session manager component used to launch SAP transactions
SAP installations running ABAP transactions governed by the first-screen authorization check

Discovery Timeline

2025-10-14 - CVE-2025-42908 published to the National Vulnerability Database
2026-10-08 - Last updated in the NVD database

Technical Details for CVE-2025-42908

Vulnerability Analysis

SAP NetWeaver Application Server for ABAP enforces authorization checks when a user opens the first screen of a transaction. The session manager interface, however, allows an authenticated user to initiate transactions directly. The initial screen is skipped, and with it the authorization check tied to that screen.

An attacker who can lure an authenticated SAP user to a malicious page can forge requests that invoke restricted transactions. Because the session manager accepts these requests under the victim's session, actions execute with the victim's permissions. This widens the effective privileges of lower-authorized users and exposes restricted business logic.

See the SAP Security Note #3642021 for the vendor's technical description.

Root Cause

The root cause is a missing CSRF protection combined with a server-side control flow that bypasses the first transaction screen. The authorization check is bound to that screen rather than to the transaction entry point in the session manager. When the screen is skipped, no equivalent check is enforced.

Attack Vector

Exploitation requires an authenticated SAP session and user interaction with attacker-controlled content such as a crafted link or embedded request. The attack is launched over the network against the SAP Web interface. No elevated privileges are required beyond a standard authenticated account.

No public proof-of-concept or in-the-wild exploitation has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-42908

Indicators of Compromise

Session manager requests that invoke sensitive transaction codes without a preceding first-screen load for that transaction
Transaction executions originating from HTTP referers outside the SAP GUI or trusted SAP front-end domains
Repeated transaction launches tied to a single session following an external navigation event

Detection Strategies

Correlate SAP Security Audit Log (SM20) entries for transaction starts against expected user authorization profiles
Review web dispatcher and ICM logs for session manager calls containing transaction codes submitted via unexpected HTTP methods or referers
Alert on execution of high-privilege transactions by users whose role should not permit them

Monitoring Recommendations

Enable and forward the SAP Security Audit Log to a centralized SIEM for correlation across sessions and endpoints
Baseline normal session manager usage per user role and flag deviations
Monitor for authenticated SAP users browsing untrusted web content from the same workstation where SAP GUI or Web GUI is active

How to Mitigate CVE-2025-42908

Immediate Actions Required

Apply SAP Security Note #3642021 to all affected NetWeaver Application Server for ABAP instances
Review user authorizations and restrict access to sensitive transactions following least-privilege principles
Audit recent session manager activity for unexpected transaction executions by lower-privileged accounts

Patch Information

SAP released a fix as part of the SAP Security Patch Day. Patch details and download links are available in SAP Security Note #3642021 and the SAP Security Patch Day Announcement. Administrators should schedule installation through their standard SAP change-management process.

Workarounds

Restrict access to the SAP session manager interface at the network or reverse-proxy layer where feasible
Enforce stricter transaction-level authorization objects so permissions do not rely solely on the first-screen check
Educate SAP users to log out of SAP sessions before browsing untrusted web content to reduce CSRF exposure

bash

# Configuration example
# Review and restrict transaction authorizations in SAP
# Transaction: SU01 (user maintenance) and PFCG (role maintenance)
# Validate that S_TCODE authorization object is correctly scoped per role
# After patch install, verify version using transaction SPAM / SNOTE 3642021