CVE-2025-42924 Overview
CVE-2025-42924 is an open redirect vulnerability [CWE-601] affecting the SAP E-Recruiting Business Server Page (BSP) component within SAP S/4HANA landscapes. An unauthenticated attacker can craft a malicious link that, when clicked by a victim, redirects the browser to an attacker-controlled page. The flaw enables phishing and credential harvesting campaigns by abusing the trust users place in the legitimate SAP domain. SAP addressed the issue through SAP Note #3642398, released as part of the SAP Security Patch Day cycle.
Critical Impact
The vulnerability enables phishing and social engineering attacks by leveraging the trusted SAP domain to redirect users to malicious pages, with low impact on confidentiality and integrity.
Affected Products
- SAP S/4HANA landscape
- SAP E-Recruiting Business Server Page (BSP)
- SAP application stacks integrating the E-Recruiting component
Discovery Timeline
- 2025-11-11 - CVE-2025-42924 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-42924
Vulnerability Analysis
The vulnerability resides in the SAP E-Recruiting BSP application, which handles candidate-facing recruiting workflows within SAP S/4HANA. The component accepts a redirect target parameter from user-supplied input without adequately validating that the destination belongs to a trusted domain. Because the entry point is exposed over the network and requires no authentication, any attacker can generate a crafted URL. User interaction is required — the victim must click the link — and the exploit crosses a trust boundary, since the initial URL appears to originate from the legitimate SAP host. Successful exploitation produces limited disclosure of session context and manipulation of the user's browsing flow but does not affect service availability.
Root Cause
The root cause is improper validation of a URL redirect parameter processed by the E-Recruiting BSP handler [CWE-601: URL Redirection to Untrusted Site]. The application uses the parameter directly to construct an HTTP redirect response instead of comparing the target against an allowlist of internal SAP endpoints.
Attack Vector
An attacker constructs a link pointing to the vulnerable SAP E-Recruiting BSP endpoint and appends a redirect parameter containing an attacker-controlled URL. The attacker distributes the link through phishing email, chat, or a compromised web page. When the victim clicks the link, the SAP server returns an HTTP 30x response that sends the browser to the malicious destination. The attacker typically hosts a lookalike SAP login page to capture credentials or serves a drive-by download. Because the initial request targets a legitimate SAP hostname, URL filtering and user judgment are less likely to flag the request.
The vulnerability manifests through unsafe handling of a redirect query parameter in the BSP request handler. See SAP Note #3642398 for technical details.
Detection Methods for CVE-2025-42924
Indicators of Compromise
- HTTP requests to SAP E-Recruiting BSP endpoints containing external URLs in redirect, sap-url, or return parameters.
- Outbound HTTP 302 responses from SAP hosts pointing to domains outside the organization's trusted allowlist.
- Referrer logs on external domains showing traffic sourced from internal SAP E-Recruiting URLs.
Detection Strategies
- Inspect SAP Web Dispatcher and ICM access logs for query parameters containing fully qualified external URLs or protocol-relative prefixes such as //.
- Deploy web application firewall rules that flag redirect parameters pointing to hosts outside the SAP domain.
- Correlate email gateway telemetry with URL click events targeting SAP E-Recruiting paths to identify phishing lures.
Monitoring Recommendations
- Alert on unusual clusters of clicks against E-Recruiting BSP URLs originating from external referrers or newly registered domains.
- Monitor authentication failures and password reset activity following user interaction with suspicious SAP links.
- Enable SAP Enterprise Threat Detection or equivalent audit logging on the E-Recruiting BSP application.
How to Mitigate CVE-2025-42924
Immediate Actions Required
- Apply the SAP-provided fix documented in SAP Note #3642398 to all S/4HANA systems running the E-Recruiting BSP component.
- Inventory internet-exposed SAP E-Recruiting endpoints and restrict access through the SAP Web Dispatcher or a reverse proxy where possible.
- Notify user populations about phishing risks that leverage trusted SAP URLs.
Patch Information
SAP released the corrective note on the November 2025 Security Patch Day. Administrators should implement SAP Note #3642398 and validate the update through the SAP Security Patch Day advisory at SAP Security Patch Day. No workaround replaces the official patch.
Workarounds
- Configure SAP Web Dispatcher or an upstream proxy to strip or validate redirect parameters submitted to E-Recruiting BSP endpoints.
- Enforce an allowlist of permitted redirect destinations at the reverse proxy so only internal SAP hosts are honored.
- Disable public exposure of the E-Recruiting BSP application until the patch is deployed if the service is not business-critical.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
