CVE-2025-42952: SAP Business Warehouse DoS Vulnerability

CVE-2025-42952 Overview

CVE-2025-42952 affects SAP Business Warehouse and SAP Plug-In Basis. The vulnerability allows an authenticated attacker to add fields to arbitrary SAP database tables and structures. Successful exploitation triggers short dumps on user login, rendering the system unusable.

The issue is classified as a Missing Authorization weakness [CWE-862]. Data confidentiality and integrity are not affected, since no data can be read, changed, or deleted. The impact is limited to availability, but the consequence is a non-functional SAP environment until the underlying schema corruption is reversed.

Critical Impact
An authenticated attacker can corrupt arbitrary SAP database tables and structures, causing short dumps on login and full availability loss across affected SAP Business Warehouse and SAP Plug-In Basis deployments.

Affected Products

SAP Business Warehouse
SAP Plug-In Basis
SAP systems exposing Business Warehouse functionality with the affected components

Discovery Timeline

2025-07-08 - CVE-2025-42952 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-42952

Vulnerability Analysis

The vulnerability resides in functionality exposed by SAP Business Warehouse and SAP Plug-In Basis that performs data dictionary modifications. The affected code paths permit an authenticated user to append fields to arbitrary database tables and structures without verifying that the caller holds the required administrative authorization.

The attack scope is changed, meaning exploitation impacts components beyond the vulnerable module. Because table structures are shared across the SAP application stack, schema modifications propagate to runtime objects. On subsequent logins, the runtime fails to reconcile the altered structures and emits ABAP short dumps, blocking user sessions and administrative access.

The required privilege level is low, which means standard business users with valid credentials can reach the vulnerable interface. Network reachability and low attack complexity make exploitation straightforward once an attacker holds any authenticated session on the SAP system.

Root Cause

The root cause is a missing authorization check [CWE-862] on data dictionary modification operations within SAP Business Warehouse and SAP Plug-In Basis. The component accepts requests to add fields to tables and structures without validating that the calling user is authorized to perform schema changes. The application logic assumes the operation is reserved for administrators but does not enforce that assumption with an authority check.

Attack Vector

An attacker authenticates to the SAP system with any valid user account. The attacker invokes the affected Business Warehouse or Plug-In Basis functionality and submits requests that append fields to target tables or structures. The modification is persisted to the SAP Data Dictionary (DDIC). Subsequent login attempts and runtime operations referencing the altered structures trigger ABAP short dumps, producing a denial-of-service condition. Refer to SAP Note #3623255 for the authoritative technical description.

Detection Methods for CVE-2025-42952

Indicators of Compromise

Unexpected entries in the DDIC change history (transaction SCU3) showing field additions to standard or custom tables by non-administrative users.
Sudden spike in ABAP short dumps logged in transaction ST22, particularly with errors related to structure mismatches or TABLE_INVALID_TYPE.
Failed login sessions for multiple users after a recent change to shared structures or master data tables.
Transport requests or repository changes originating from accounts that do not normally perform development activity.

Detection Strategies

Review SAP Security Audit Log (SM19/SM20) for invocations of data dictionary modification functions by users without the S_DEVELOP authorization object.
Correlate authentication failures and short dumps with recent DDIC activity to identify exploitation attempts.
Monitor change documents on tables DD02L, DD03L, and DD09L for unauthorized field additions.

Monitoring Recommendations

Forward SAP Security Audit Log, system log, and short dump records to a centralized SIEM for correlation across users, terminals, and transactions.
Alert on any DDIC modification performed outside approved change windows or by accounts lacking administrator roles.
Track invocation frequency of Business Warehouse function modules from unexpected client IDs or RFC destinations.

How to Mitigate CVE-2025-42952

Immediate Actions Required

Apply the SAP patch referenced in SAP Note #3623255 to all affected SAP Business Warehouse and SAP Plug-In Basis systems.
Restrict access to Business Warehouse functionality to users who require it for their role, and remove dialog access for service accounts.
Audit recent DDIC changes and reverse any unauthorized field additions before they propagate further across the landscape.
Enable the SAP Security Audit Log with full coverage of DDIC and authorization-relevant events.

Patch Information

SAP released a corrective patch as part of the SAP Security Patch Day cycle. The fix is documented in SAP Note #3623255. Customers should consult the SAP Security Patch Day portal to confirm the applicable support package or correction instructions for their release. Apply the patch in non-production environments first, verify Business Warehouse functionality, and then promote through the transport landscape.

Workarounds

Tighten authorization profiles so that only designated administrators hold the authority objects required to modify data dictionary structures.
Disable or restrict access to the affected Business Warehouse function modules through SU24 and role redesign until the patch is deployed.
Limit network reachability of the SAP application servers to trusted segments and enforce strong authentication for all interactive and RFC users.

bash

# Example: review recent DDIC table changes via SAP transaction codes
# SCU3 - Table history
# SE16 -> table DBTABLOG for logged table changes
# ST22 - ABAP runtime errors / short dumps
# SM20 - Security Audit Log review