CVE-2025-42919: SAP NetWeaver Information Disclosure Flaw

CVE-2025-42919 Overview

CVE-2025-42919 is an information disclosure vulnerability in SAP NetWeaver Application Server Java. The flaw allows unauthenticated attackers to access internal metadata files through manipulated URLs. Attackers insert arbitrary path components into HTTP requests, bypassing intended access restrictions on sensitive application metadata.

Successful exploitation results in a partial compromise of confidentiality. The integrity and availability of the application server remain unaffected. The weakness is classified as improper limitation of a pathname to a restricted directory [CWE-22].

Critical Impact
Unauthenticated remote attackers can retrieve sensitive internal metadata from SAP NetWeaver Application Server Java by inserting arbitrary path components in URL requests, exposing application configuration details useful for follow-on attacks.

Affected Products

SAP NetWeaver Application Server Java
Specific version details are published in SAP Note #3643603
Refer to SAP Security Patch Day advisories for the complete product matrix

Discovery Timeline

2025-11-11 - CVE-2025-42919 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-42919

Vulnerability Analysis

The vulnerability resides in how SAP NetWeaver Application Server Java processes HTTP request paths. The server does not adequately validate path components supplied by clients before resolving requests against internal resources. This weakness allows an unauthenticated attacker to craft URLs that direct the server to return internal metadata files not intended for external access.

Internal metadata in SAP NetWeaver Application Server Java typically includes configuration descriptors, deployment information, and application component data. Exposure of this data provides attackers with reconnaissance intelligence. Attackers can use disclosed information to map internal application structure, locate additional attack surfaces, and refine follow-on exploitation attempts.

The attack is network-based and requires no authentication or user interaction. The Exploit Prediction Scoring System (EPSS) currently rates in-the-wild exploitation likelihood at a low percentile, and no public proof-of-concept has been published at time of writing.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22], commonly known as path traversal. The application fails to sanitize or canonicalize path components before mapping request URLs to internal resources. This allows arbitrary path segments in the request to reach files outside the intended web-exposed resource scope.

Attack Vector

An attacker sends a specially crafted HTTP request to the SAP NetWeaver Application Server Java. The request contains manipulated path components that redirect resource resolution toward internal metadata files. Because no authentication is required, any network-reachable attacker can execute the request.

The server returns the metadata content in the HTTP response. Attackers repeat the process against different metadata paths to enumerate internal application data. See SAP Note #3643603 for authoritative technical details.

Detection Methods for CVE-2025-42919

Indicators of Compromise

HTTP requests to SAP NetWeaver Java endpoints containing traversal sequences such as ../, encoded variants (%2e%2e%2f), or unexpected path segments before known application paths
Access log entries showing successful HTTP 200 responses to non-standard URI paths targeting internal or metadata directories
Requests originating from unfamiliar external IP addresses to Application Server Java ports (default 50000-range HTTP ports)

Detection Strategies

Deploy web application firewall (WAF) rules that identify path traversal patterns and encoded traversal sequences in requests to SAP NetWeaver endpoints
Correlate access logs against baselines of legitimate URL paths for deployed SAP applications and alert on deviations
Hunt for anomalous response sizes and content types returned from unusual URI paths, which may indicate metadata disclosure

Monitoring Recommendations

Enable verbose HTTP request logging on SAP NetWeaver Application Server Java, including full request URIs and query parameters
Forward SAP NetWeaver access and audit logs to a centralized SIEM for correlation with network telemetry
Set alerting thresholds on repeated 200 OK responses to non-standard paths from a single source IP within short time windows

How to Mitigate CVE-2025-42919

Immediate Actions Required

Apply the security patch referenced in SAP Note #3643603 as soon as feasible after change validation
Restrict network access to SAP NetWeaver Application Server Java management and application ports to trusted networks only
Review recent access logs for signs of path manipulation attempts targeting internal metadata endpoints

Patch Information

SAP released the fix as part of the SAP Security Patch Day process. Administrators should consult SAP Note #3643603 for the exact patch bundle, affected support package levels, and installation instructions. Additional context is available at the SAP Security Patch Day portal.

Workarounds

Place SAP NetWeaver Application Server Java behind a reverse proxy or WAF configured to block path traversal patterns and reject requests containing encoded traversal sequences
Enforce strict URL allow-lists at the network edge, permitting only known application paths to reach the SAP server
Where patching is delayed, limit exposure of the Application Server Java to internal networks and VPN-connected users only

bash

# Example WAF rule concept (ModSecurity-style) to block path traversal to SAP NetWeaver
SecRule REQUEST_URI "@rx (\.\./|%2e%2e%2f|%2e%2e/|\.\.%2f)" \
    "id:1000042919,\
    phase:1,\
    deny,\
    status:403,\
    msg:'Potential CVE-2025-42919 path traversal against SAP NetWeaver Java'"