CVE-2025-42910: SAP SRM File Upload RCE Vulnerability

CVE-2025-42910 Overview

CVE-2025-42910 is a critical unrestricted file upload vulnerability affecting SAP Supplier Relationship Management (SRM). Due to missing verification of file type or content, the application allows authenticated attackers to upload arbitrary files, including executable content. These malicious files could be downloaded and executed by unsuspecting users, potentially leading to malware deployment across the enterprise environment.

Critical Impact

Successful exploitation enables attackers to upload malicious executables that can compromise user workstations, leading to high impact on confidentiality, integrity, and availability of the application and connected systems.

Affected Products

• SAP Supplier Relationship Management (SRM)

Discovery Timeline

• October 14, 2025 - CVE-2025-42910 published to NVD
• October 14, 2025 - Last updated in NVD database

Technical Details for CVE-2025-42910

Vulnerability Analysis

This vulnerability is classified as CWE-434: Unrestricted Upload of File with Dangerous Type. The SAP Supplier Relationship Management application fails to properly validate uploaded files, allowing authenticated users to bypass intended restrictions and upload arbitrary file types. The attack requires network access and low privileges, though user interaction is required for the malicious payload to execute—typically when another user downloads and runs the uploaded file.

The scope is changed (S:C in the CVSS vector), meaning the vulnerable component can impact resources beyond its security scope. This is particularly concerning in enterprise environments where SAP SRM is often integrated with other business-critical systems and accessed by multiple users with varying privilege levels.

Root Cause

The root cause is the absence of server-side validation for uploaded file types and content. The application does not verify:

• File extension against an allowlist of permitted types
• MIME type verification
• File content/magic bytes validation
• Executable content detection

This allows attackers to upload files with dangerous extensions (such as .exe, .bat, .ps1, or other executable formats) that would normally be blocked by proper file upload security controls.

Attack Vector

The attack follows a multi-stage process leveraging the file upload functionality:

1. An authenticated attacker accesses the file upload feature within SAP SRM
2. The attacker crafts a malicious file (e.g., a trojanized executable or script)
3. The malicious file is uploaded, bypassing any client-side validation
4. The server accepts and stores the file without proper type/content verification
5. When another user downloads and executes the file, the malicious payload activates
6. The attacker gains access to the victim's system, potentially enabling lateral movement

The network-based attack vector combined with the changed scope makes this vulnerability particularly dangerous in environments where SAP SRM serves as a central platform for supplier interactions.

Detection Methods for CVE-2025-42910

Indicators of Compromise

• Unusual file types appearing in SAP SRM file storage directories (.exe, .bat, .ps1, .dll, .scr)
• Executable files with disguised extensions or double extensions (e.g., document.pdf.exe)
• Spike in file upload activity from specific user accounts
• Users reporting unexpected file downloads or execution prompts
• Endpoint detection alerts triggered by files originating from SAP SRM storage paths

Detection Strategies

• Implement file integrity monitoring on SAP SRM upload directories to detect suspicious file types
• Configure SIEM rules to alert on executable file uploads to SAP SRM components
• Monitor SAP Security Audit Log (SM21) for unusual file upload patterns
• Deploy endpoint detection solutions to identify execution of files from SAP-related download paths
• Analyze web application firewall logs for attempts to upload files with executable MIME types

Monitoring Recommendations

• Enable verbose logging for all file upload operations within SAP SRM
• Configure real-time alerting for uploads of potentially dangerous file types
• Monitor user download patterns from SAP SRM storage to identify potential victim systems
• Review SAP SRM access logs regularly for anomalous authenticated session behavior

How to Mitigate CVE-2025-42910

Immediate Actions Required

• Apply the security patch referenced in SAP Note #3647332 immediately
• Review recent file uploads to SAP SRM for any suspicious or executable content
• Temporarily restrict file upload functionality to trusted user groups if patching is not immediately possible
• Notify users to avoid downloading and executing any unfamiliar files from SAP SRM
• Scan SAP SRM file storage for existing malicious uploads

Patch Information

SAP has released a security patch to address this vulnerability. Organizations should apply the fix documented in SAP Note #3647332. Additional details are available through the SAP Security Patch Day portal.

Administrators should follow standard SAP patching procedures including:

• Testing the patch in a non-production environment first
• Scheduling a maintenance window for production deployment
• Verifying file upload restrictions are properly enforced post-patching

Workarounds

• Implement server-side file type validation at the web server or reverse proxy level to block executable uploads
• Configure allowlists for permitted file extensions (e.g., .pdf, .docx, .xlsx)
• Deploy a web application firewall rule to inspect and block uploads containing executable content
• Restrict file upload functionality to essential users only until the patch is applied
• Enable content scanning/antivirus integration for all uploaded files