CVE-2025-42938: SAP NetWeaver ABAP Platform XSS Flaw

CVE-2025-42938 Overview

CVE-2025-42938 is a reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] in the SAP NetWeaver ABAP Platform. An unauthenticated attacker can craft a malicious link and distribute it publicly. When an authenticated user clicks the link, the injected payload is processed during page generation and executed in the victim's browser context. The executed script can read or modify data within the victim's browser scope, affecting confidentiality and integrity. Availability is not impacted. SAP addressed the flaw as part of its September 2025 Security Patch Day.

Critical Impact
An unauthenticated attacker can hijack an authenticated SAP user's session context, exfiltrate sensitive business data, or perform actions on behalf of the victim by leveraging a single crafted URL.

Affected Products

SAP NetWeaver ABAP Platform (versions listed in SAP Note #3629325)
SAP applications running on the affected NetWeaver ABAP stack
Web-facing SAP components that render user-supplied input during page generation

Discovery Timeline

2025-09-09 - CVE-2025-42938 published to the National Vulnerability Database (NVD)
2025-09-09 - SAP releases fix via SAP Note #3629325 on Security Patch Day
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-42938

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in a web-facing component of the SAP NetWeaver ABAP Platform. Attacker-controlled input passed through a URL parameter is echoed into the server-rendered HTML response without adequate output encoding. When the browser parses the response, it interprets attacker-supplied markup or script as legitimate page content.

Exploitation requires user interaction: an authenticated SAP user must click the crafted link. Because the script executes within the authenticated session, it inherits the user's privileges within the SAP application. The scope change indicated in the vulnerability metadata reflects that injected code can act beyond the vulnerable component's security boundary, for example against the wider browser origin or federated SAP services.

Impact is limited to confidentiality and integrity of data reachable from the victim's browser. Availability of the SAP system itself is not affected.

Root Cause

The root cause is missing or insufficient contextual output encoding of user-supplied input during HTML page generation, consistent with [CWE-79]. Input received over the network is reflected into the response body in a context (HTML, attribute, or JavaScript) where control characters are not neutralized.

Attack Vector

The attack vector is network-based and unauthenticated on the attacker side. The attacker generates a URL that embeds a script payload in a vulnerable request parameter and distributes it through phishing, forum posts, chat messages, or watering-hole pages. A logged-in SAP user who clicks the link triggers the reflected payload in their browser session.

No verified exploit code is publicly available. Refer to SAP Note #3629325 for
vendor-provided technical details on the affected parameter and code path.

Detection Methods for CVE-2025-42938

Indicators of Compromise

Inbound HTTP requests to SAP NetWeaver ABAP endpoints containing script tags, javascript: URIs, onerror=, onload=, or encoded variants such as %3Cscript%3E in query parameters
Referer headers pointing to external, untrusted domains preceding authenticated SAP sessions
Unusual outbound requests from SAP user browsers to attacker-controlled hosts shortly after link clicks
SAP application logs showing reflected parameter values that contain HTML or JavaScript control characters

Detection Strategies

Deploy Web Application Firewall (WAF) signatures that flag XSS payload patterns targeting SAP NetWeaver URL paths
Correlate email or messaging gateway telemetry with SAP access logs to identify users who clicked externally-sourced SAP URLs
Hunt for anomalous DOM modifications and outbound fetch/XMLHttpRequest calls originating from SAP application pages using browser or endpoint telemetry

Monitoring Recommendations

Enable verbose HTTP request logging on SAP Internet Communication Manager (ICM) and forward logs to a centralized SIEM for pattern analysis
Alert on SAP session activity that immediately follows a redirect from an untrusted external referrer
Monitor for exfiltration attempts of SAP session cookies or authentication tokens over unusual destinations

How to Mitigate CVE-2025-42938

Immediate Actions Required

Apply the fix documented in SAP Note #3629325 to all affected SAP NetWeaver ABAP systems
Review the SAP Security Patch Day bulletin to confirm the exact affected Support Package levels in your landscape
Notify SAP end users of the phishing risk and remind them to avoid clicking unsolicited SAP links

Patch Information

SAP published the correction as part of the September 2025 Security Patch Day. The fix is delivered through SAP Note #3629325, which contains the applicable Support Package versions and manual correction instructions. Customers should apply the note through SAP Note Assistant (SNOTE) or install the corresponding Support Package as soon as change windows permit.

Workarounds

Restrict external network access to SAP NetWeaver web interfaces where business requirements allow, reducing exposure to unauthenticated attackers
Enforce a strict Content Security Policy (CSP) on SAP web responses to limit inline script execution
Configure SAP Web Dispatcher or an upstream reverse proxy to filter requests containing HTML control characters in query parameters until patches are applied

bash

# Example: apply SAP Note via SNOTE transaction
# 1. Log into the affected SAP system as an administrator
# 2. Run transaction SNOTE
# 3. Download SAP Note 3629325
# 4. Implement the note and verify via SPAM/SAINT that the
#    required Support Package level is active