CVE-2025-42922: SAP NetWeaver AS Java RCE Vulnerability

CVE-2025-42922 Overview

CVE-2025-42922 is a critical Code Injection vulnerability affecting SAP NetWeaver AS Java. The vulnerability allows an attacker authenticated as a non-administrative user to exploit a flaw in an available service to upload an arbitrary file. When this uploaded file is executed, it can lead to a full compromise of confidentiality, integrity, and availability of the system.

Critical Impact

An authenticated attacker with low privileges can achieve complete system compromise through arbitrary file upload and code execution, potentially affecting connected systems due to the changed scope of impact.

Affected Products

• SAP NetWeaver AS Java (specific affected versions detailed in SAP Note #3643865)

Discovery Timeline

• 2025-09-09 - CVE-2025-42922 published to NVD
• 2025-09-09 - Last updated in NVD database

Technical Details for CVE-2025-42922

Vulnerability Analysis

This vulnerability is classified under CWE-94 (Improper Control of Generation of Code - Code Injection). The flaw exists within a service component of SAP NetWeaver AS Java that fails to properly validate and restrict file uploads from authenticated users. Even users with minimal privileges can exploit this weakness to upload malicious files to the server.

The impact extends beyond the vulnerable component itself, as indicated by the changed scope characteristic. This means successful exploitation can affect resources beyond the security scope of the vulnerable component, potentially compromising other connected systems or services within the SAP landscape.

Root Cause

The root cause of CVE-2025-42922 lies in insufficient validation controls within a file upload service in SAP NetWeaver AS Java. The service fails to properly validate:

1. File type and content validation - allowing executable or script files to be uploaded
2. Authorization checks - permitting non-administrative users to access file upload functionality
3. Upload destination restrictions - enabling files to be placed in locations where they can be executed

Attack Vector

The attack vector for this vulnerability is network-based, requiring only low-level authenticated access. An attacker needs valid credentials for any non-administrative user account to exploit this vulnerability. The attack flow typically involves:

1. Authenticating to the SAP NetWeaver AS Java instance with any valid user credentials
2. Accessing the vulnerable file upload service
3. Uploading a malicious file (such as a web shell or script)
4. Triggering execution of the uploaded file
5. Achieving full system compromise with access to confidential data, ability to modify system integrity, and potential to disrupt availability

No user interaction is required beyond the initial authentication, making this vulnerability particularly dangerous in environments with many user accounts.

Detection Methods for CVE-2025-42922

Indicators of Compromise

• Unexpected file uploads to SAP NetWeaver AS Java application directories
• Presence of web shells or unfamiliar executable files in web-accessible directories
• Unusual outbound network connections from the SAP NetWeaver server
• Log entries showing file upload activities from non-administrative user accounts

Detection Strategies

• Monitor SAP Security Audit Log for unusual file upload operations
• Implement file integrity monitoring on SAP NetWeaver AS Java directories
• Review web server access logs for requests to unexpected file paths
• Analyze network traffic for command and control communication patterns

Monitoring Recommendations

• Enable comprehensive logging for all file upload services within SAP NetWeaver
• Deploy endpoint detection and response (EDR) solutions on SAP application servers
• Configure alerts for new file creation events in sensitive directories
• Implement regular security scanning of SAP NetWeaver instances

How to Mitigate CVE-2025-42922

Immediate Actions Required

• Apply the security patch referenced in SAP Note #3643865 immediately
• Review user accounts and remove unnecessary access privileges
• Audit recent file upload activities for signs of exploitation
• Consider temporarily restricting access to the vulnerable service until patching is complete

Patch Information

SAP has released a security update addressing this vulnerability as part of SAP Security Patch Day. Administrators should download and apply the patch detailed in SAP Note #3643865. Given the critical severity rating and the potential for complete system compromise, patching should be prioritized as an emergency remediation activity.

Workarounds

• Restrict network access to SAP NetWeaver AS Java to trusted IP ranges only
• Implement additional authentication controls such as multi-factor authentication
• Disable or restrict access to the vulnerable file upload service if not business-critical
• Deploy web application firewall (WAF) rules to block malicious file upload attempts
• Monitor and alert on all file upload activities pending patch deployment