CVE-2025-42950 Overview
SAP Landscape Transformation (SLT) contains a critical code injection vulnerability that allows an attacker with user privileges to exploit a flaw in a function module exposed via RFC (Remote Function Call). This vulnerability enables the injection of arbitrary ABAP code into the system, bypassing essential authorization checks. The flaw effectively functions as a backdoor, creating the risk of full system compromise and undermining the confidentiality, integrity, and availability of the affected SAP system.
Critical Impact
This vulnerability allows authenticated attackers to inject and execute arbitrary ABAP code, potentially leading to complete system takeover, data exfiltration, and persistent backdoor access to SAP environments.
Affected Products
- SAP Landscape Transformation (SLT)
- SAP systems with SLT function modules exposed via RFC
- SAP NetWeaver environments utilizing SLT components
Discovery Timeline
- 2025-08-12 - CVE-2025-42950 published to NVD
- 2025-08-12 - Last updated in NVD database
Technical Details for CVE-2025-42950
Vulnerability Analysis
This vulnerability is classified under CWE-94 (Improper Control of Generation of Code - Code Injection), which describes flaws where software constructs code segments using externally-influenced input without proper neutralization. In the context of SAP Landscape Transformation, the vulnerable function module exposed via RFC fails to adequately validate and sanitize input parameters before processing them, allowing malicious ABAP code to be injected and executed within the system context.
The attack can be conducted remotely over the network by any user with basic privileges to the SAP system. The changed scope characteristic of this vulnerability indicates that a successful exploit can affect resources beyond the vulnerable component itself, potentially compromising other integrated SAP modules and connected systems.
Root Cause
The root cause lies in insufficient input validation and missing authorization checks within the RFC-enabled function module in SAP Landscape Transformation. The function module accepts user-controlled input that is subsequently processed without adequate sanitization, allowing specially crafted payloads containing ABAP code to be interpreted and executed by the system. This design flaw bypasses the normal security controls that should prevent unauthorized code execution within the ABAP runtime environment.
Attack Vector
The attack is executed remotely over the network by authenticated users with minimal privileges. An attacker can craft malicious RFC calls targeting the vulnerable function module, embedding ABAP code within the input parameters. When the function module processes this input without proper validation, the injected ABAP code is executed with the privileges of the application context, potentially allowing:
- Execution of arbitrary system commands
- Access to sensitive business data and configuration
- Modification or deletion of critical database records
- Creation of persistent backdoor accounts
- Lateral movement to connected SAP systems
The vulnerability does not require user interaction and can be exploited programmatically, making it particularly dangerous in automated attack scenarios.
Detection Methods for CVE-2025-42950
Indicators of Compromise
- Unusual RFC calls to SLT function modules from unexpected source systems or user accounts
- Anomalous ABAP execution patterns, especially dynamic code generation or execution statements
- Unexpected user accounts or authorization changes in SAP systems
- Suspicious transaction log entries showing unauthorized access to sensitive tables
Detection Strategies
- Monitor SAP Security Audit Log (SM21) for RFC calls to SLT-related function modules with unusual parameters
- Implement SAP Solution Manager Early Watch alerts for anomalous code execution patterns
- Review RFC connection logs for unauthorized external system communications
- Enable enhanced tracing on SLT function modules to capture detailed call parameters
Monitoring Recommendations
- Configure SIEM integration with SAP audit logs to detect suspicious RFC activity in real-time
- Establish baseline behavior for SLT function module usage and alert on deviations
- Monitor for new ABAP programs or includes created outside normal change management processes
- Review SAP Gateway logs for anomalous inbound RFC traffic patterns
How to Mitigate CVE-2025-42950
Immediate Actions Required
- Apply the security patch referenced in SAP Note #3633838 immediately
- Review and restrict RFC authorizations for SLT function modules to essential users only
- Audit user accounts with RFC access to identify potentially compromised credentials
- Enable enhanced logging on vulnerable function modules pending patch deployment
Patch Information
SAP has released a security update addressing this vulnerability. Detailed patch information and implementation guidance are available through SAP Note #3633838. Organizations should prioritize this patch given the critical severity and the potential for full system compromise. The patch was released as part of SAP Security Patch Day, and administrators should follow standard SAP transport import procedures to deploy the fix.
Workarounds
- Restrict RFC access to SLT function modules using authorization object S_RFC with explicit allowed function module lists
- Implement network segmentation to limit RFC connectivity to trusted source systems only
- Temporarily disable external RFC access to affected function modules if business operations permit
- Enable SAP ICM (Internet Communication Manager) access controls to restrict inbound RFC traffic
# SAP Authorization restriction example for S_RFC
# Restrict RFC access to specific SLT function modules
# Configure in transaction SU24/PFCG
# Review RFC authorizations with:
# Transaction: SUIM -> Users by Complex Selection Criteria -> By Authorization Values
# Authorization Object: S_RFC
# RFC_TYPE: FUNC
# RFC_NAME: *SLT* (to identify users with SLT function access)
# Network-level mitigation - restrict SAP Gateway access
# Add to SAP profile parameter:
gw/acl_mode = 1
gw/sec_info = /usr/sap/<SID>/SYS/global/secinfo.dat
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
