CVE-2025-42923: SAP Fiori App CSRF Vulnerability

CVE-2025-42923 Overview

CVE-2025-42923 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the SAP Fiori App Manage Work Center Groups. The flaw stems from insufficient CSRF protection on the web server. An attacker can craft a malicious request and trick an authenticated user into submitting it, causing the server to perform unintended state-changing actions on behalf of that user.

The vulnerability has low impact on integrity and no impact on confidentiality or availability. Exploitation requires an authenticated session on the SAP Fiori application. SAP addressed the issue in the September 2025 Security Patch Day release.

Critical Impact
An authenticated SAP Fiori user can be coerced into submitting attacker-crafted requests that modify Work Center Group data without their consent.

Affected Products

SAP Fiori App Manage Work Center Groups
SAP S/4HANA deployments exposing the affected Fiori application
Refer to SAP Note #3450692 for the full list of impacted versions

Discovery Timeline

2025-09-09 - CVE-2025-42923 published to the National Vulnerability Database (NVD)
2025-09-09 - SAP releases security patch as part of SAP Security Patch Day
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-42923

Vulnerability Analysis

The SAP Fiori App Manage Work Center Groups does not enforce adequate anti-CSRF token validation on at least one state-changing endpoint. SAP Fiori applications typically rely on the X-CSRF-Token header to protect POST, PUT, and DELETE operations against cross-origin forgery. When this validation is missing or improperly enforced, the server accepts cross-origin requests that carry the victim's session cookies.

An attacker exploits this gap by hosting a malicious page that triggers a background request to the vulnerable endpoint. If an authenticated SAP user visits the page in the same browser session, the browser automatically attaches session cookies to the forged request. The server processes the request as if it originated from the legitimate user.

Impact is limited to integrity. The attacker cannot read data returned by the request, and the application remains available. However, Work Center Group configurations may be modified without authorization.

Root Cause

The root cause is missing or insufficient CSRF token enforcement on a Fiori application endpoint [CWE-352]. The server trusts the session cookie as the sole authentication signal, violating the defense-in-depth model that requires a secondary unforgeable token.

Attack Vector

Exploitation requires network access to the SAP Fiori endpoint and a victim with an active authenticated session. The attacker must deliver the malicious payload through a web page, email, or messaging link. User interaction is required only to visit the attacker-controlled resource; no additional clicks on the forged request are needed.

The vulnerability manifests when a browser submits a cross-origin request containing session credentials but no valid CSRF token. See SAP Note #3450692 for technical details on affected endpoints.

Detection Methods for CVE-2025-42923

Indicators of Compromise

Unexpected modifications to Work Center Group records in SAP audit logs
HTTP requests to Manage Work Center Groups endpoints with a Referer or Origin header pointing to an external domain
State-changing requests lacking the X-CSRF-Token header or carrying an empty token value
SAP user sessions performing configuration changes outside normal business hours or workflow patterns

Detection Strategies

Enable SAP Security Audit Log (SM19/RSAU_CONFIG) and monitor change documents for Work Center Group objects
Deploy a web application firewall rule that inspects Origin and Referer headers on Fiori state-changing requests
Correlate SAP application logs with endpoint and proxy telemetry to spot cross-origin request chains

Monitoring Recommendations

Forward SAP audit logs and reverse-proxy access logs to a centralized SIEM for correlation
Alert on administrative changes to Work Center Groups that lack a preceding legitimate UI navigation event
Baseline normal Fiori request patterns per user and flag deviations in request origin or timing

How to Mitigate CVE-2025-42923

Immediate Actions Required

Apply the SAP-provided patch referenced in SAP Note #3450692 across all affected systems
Review SAP Security Patch Day guidance at SAP Security Patch Day to identify any related notes
Audit recent changes to Work Center Group data for unauthorized modifications
Enforce least-privilege authorizations on the Manage Work Center Groups Fiori role

Patch Information

SAP released a corrective patch in the September 2025 Security Patch Day. Customers must authenticate to the SAP Support Portal to download the fix via SAP Note #3450692. Apply the patch following standard SAP transport and testing procedures.

Workarounds

Restrict access to the Manage Work Center Groups Fiori tile to a minimal set of administrators until the patch is deployed
Instruct privileged users to log out of SAP Fiori when not actively using the application to limit CSRF exposure
Configure the reverse proxy or SAP Web Dispatcher to reject requests to the affected endpoints when the Origin header does not match an allowlisted domain

bash

# Example SAP Web Dispatcher rule to block cross-origin requests
# to the vulnerable Fiori endpoint until patching completes
if %{HEADER:ORIGIN} !strcmp https://fiori.internal.example.com [AND]
if %{PATH} regimatch /sap/opu/odata/sap/.*WORK_CENTER_GROUP.*
RegRewriteResponseCode 403