CVE-2025-42943: SAP GUI for Windows NTLM Hash Leak Vulnerability

CVE-2025-42943 Overview

CVE-2025-42943 affects SAP GUI for Windows and can leak NTLM (NT LAN Manager) authentication hashes when specific ABAP (Advanced Business Application Programming) frontend services are invoked with Universal Naming Convention (UNC) paths. An attacker with developer authorization on a target Application Server ABAP can modify code to reference an attacker-controlled UNC path. When a victim executes the affected transaction through SAP GUI for Windows, Windows performs automatic NTLM authentication to the remote host, exposing the user's hashed credentials. The weakness is categorized under [CWE-250] Execution with Unnecessary Privileges and primarily affects confidentiality of authentication material.

Critical Impact
Successful exploitation exposes NTLM hashes of SAP GUI users, enabling offline cracking or NTLM relay attacks against enterprise Windows resources.

Affected Products

SAP GUI for Windows
SAP Application Server ABAP (as the code execution surface)
Windows client systems performing NTLM authentication over SMB

Discovery Timeline

2025-08-12 - CVE-2025-42943 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-42943

Vulnerability Analysis

The vulnerability arises because SAP GUI for Windows resolves UNC paths passed to certain ABAP frontend services without restricting or sanitizing remote SMB destinations. When the client resolves a path such as \\attacker.example.com\share\file, Windows initiates SMB authentication and transmits the current user's NTLM challenge-response over the network. The attacker captures the exchange using tools such as Responder or Impacket smbserver.py and extracts the NetNTLMv2 hash. The captured hash can then be cracked offline or relayed to internal services that accept NTLM.

Exploitation requires two preconditions: developer-level authorization on a target ABAP system to inject the malicious UNC reference, and a victim user who executes the affected transaction through SAP GUI for Windows. The user interaction requirement and privileged prerequisite constrain the attack, but insider threats and compromised developer accounts remain realistic vectors in large SAP environments.

Root Cause

The root cause is improper handling of file path inputs by ABAP frontend services executed on the SAP GUI client. The client accepts remote UNC destinations and triggers native Windows file operations that perform automatic NTLM authentication. No allowlist or protocol restriction prevents outbound SMB traffic to arbitrary hosts.

Attack Vector

An attacker with ABAP developer rights modifies an ABAP program to call a frontend service, such as a file existence check or file read, using a UNC path pointing to an attacker-controlled SMB server. When a victim runs the transaction in SAP GUI for Windows, the client performs SMB authentication to the remote host and leaks the NTLM hash. The attacker captures the hash for offline cracking or NTLM relay attacks against internal services.

No verified public proof-of-concept code is available. See the SAP Note #3627845 for authoritative technical details.

Detection Methods for CVE-2025-42943

Indicators of Compromise

Outbound SMB (TCP 445) connections from SAP GUI client hosts to untrusted or external IP addresses.
ABAP code changes referencing UNC paths in frontend service calls such as file I/O helpers.
Windows Security event 4624/4625 entries showing NTLM authentication attempts to unexpected destinations.
Unexpected DNS lookups for external hostnames originating from SAP GUI workstations.

Detection Strategies

Audit ABAP transport requests and version history for newly introduced UNC path literals in frontend service invocations.
Monitor endpoint telemetry for saplogon.exe or sapgui.exe processes initiating SMB sessions to non-corporate hosts.
Correlate SAP application logs with network flow data to identify frontend service calls that trigger outbound SMB traffic.

Monitoring Recommendations

Enable ABAP change logging and review developer activity in production-adjacent systems.
Deploy NTLM auditing via Group Policy (Network security: Restrict NTLM: Audit Outgoing NTLM Traffic) on SAP GUI workstations.
Alert on SMB egress from user workstations to public IP ranges or unclassified assets.

How to Mitigate CVE-2025-42943

Immediate Actions Required

Apply the SAP GUI for Windows patch referenced in SAP Note #3627845.
Review and restrict developer authorizations on ABAP systems, particularly S_DEVELOP object access in production-linked landscapes.
Block outbound SMB (TCP 445) and NetBIOS traffic from client workstations to the internet at the perimeter firewall.
Enforce SMB signing and disable NTLMv1 across the Windows environment.

Patch Information

SAP addressed this vulnerability as part of its monthly Security Patch Day. Refer to SAP Note #3627845 for the fixed SAP GUI for Windows versions and installation guidance. Additional advisories are available on the SAP Security Patch Day portal.

Workarounds

Configure Windows Defender Firewall or host-based firewalls to block outbound SMB to non-corporate destinations.
Enable the Group Policy Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers and set to Deny all or Audit all before enforcing.
Restrict ABAP developer authorizations and enforce four-eyes review on transports that touch frontend service calls.
Segment SAP GUI workstations to prevent arbitrary outbound SMB egress to untrusted networks.

bash

# Restrict outgoing NTLM authentication via Group Policy registry key
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0" /v RestrictSendingNTLMTraffic /t REG_DWORD /d 2 /f

# Block outbound SMB at the host firewall
New-NetFirewallRule -DisplayName "Block Outbound SMB" -Direction Outbound -Protocol TCP -RemotePort 445 -Action Block