CVE-2025-42956: SAP NetWeaver ABAP XSS Vulnerability

CVE-2025-42956 Overview

CVE-2025-42956 is a reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] in SAP NetWeaver Application Server ABAP and the ABAP Platform. An unauthenticated attacker can craft a malicious link and distribute it publicly. When an authenticated victim clicks the link, injected input is reflected into the web page generation process and executed in the victim's browser.

The flaw affects a broad range of SAP_BASIS releases from 700 through 816, indicating exposure across legacy and current NetWeaver ABAP deployments. Successful exploitation results in limited confidentiality and integrity impact within the victim's session, with no availability consequences.

Critical Impact
Reflected XSS enables session-context script execution against authenticated SAP users, allowing attackers to steal session data, perform actions on behalf of the user, or pivot to further SAP application abuse.

Affected Products

SAP NetWeaver Application Server ABAP (SAP_BASIS 700, 701, 702, 731, 740)
SAP NetWeaver Application Server ABAP (SAP_BASIS 750, 751, 752, 753, 754, 755, 756, 757, 758)
SAP ABAP Platform (SAP_BASIS 816)

Discovery Timeline

2025-07-08 - CVE-2025-42956 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-42956

Vulnerability Analysis

The vulnerability resides in a page generation routine within SAP NetWeaver Application Server ABAP. User-supplied input reaches HTML output without sufficient encoding or sanitization. An attacker embeds crafted payload data in URL parameters and hosts or shares the link. When an authenticated SAP user requests the URL, the server reflects the attacker's input into the response body.

Because the payload executes in the victim's browser under the SAP application's origin, the script inherits the user's session context. Attackers can read session tokens, submit ABAP transactions on behalf of the user, or exfiltrate business data visible through the SAP UI. The scope change in the vector reflects that scripts can impact resources outside the vulnerable component, such as cookies scoped to the SAP domain.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The affected ABAP components emit reflected parameter values into HTML without applying context-appropriate output encoding. This allows an attacker to break out of the intended data context and inject <script> tags or event handler attributes that the browser executes.

Attack Vector

Exploitation is network-based and requires no authentication on the attacker's side, but does require user interaction. A typical attack chain:

Attacker identifies a vulnerable SAP NetWeaver endpoint that reflects a query parameter.
Attacker crafts a URL with a malicious JavaScript payload in the vulnerable parameter.
Attacker delivers the link via phishing email, chat, or public web content.
An authenticated SAP user clicks the link, triggering script execution in their browser session.

No verified public proof-of-concept or exploit code is available for CVE-2025-42956. Refer to SAP Note #3617131 for vendor technical details.

Detection Methods for CVE-2025-42956

Indicators of Compromise

HTTP requests to SAP NetWeaver ABAP endpoints containing URL-encoded <script>, javascript:, onerror=, or onload= substrings in query parameters.
Reflected responses from SAP application servers that echo unescaped request parameters into HTML content.
Outbound browser connections from SAP user workstations to unexpected external domains immediately after clicking SAP application links.

Detection Strategies

Deploy Web Application Firewall (WAF) rules that inspect requests destined for SAP NetWeaver ABAP hosts and block common XSS payload patterns in query strings and form fields.
Correlate SAP ICM and Web Dispatcher access logs with proxy logs to identify referrer chains where external links deliver users to SAP URLs containing script-like parameter values.
Hunt for anomalous SAP user activity following inbound email link clicks, such as unexpected transaction executions or session token reuse from new IP addresses.

Monitoring Recommendations

Enable verbose logging on SAP Internet Communication Manager (ICM) and forward logs to a centralized SIEM for query parameter analysis.
Monitor SAP audit logs (SM19/SM20) for unusual user actions that follow shortly after web-based session activity.
Track email gateway and web proxy telemetry for URLs pointing to SAP hostnames that carry encoded scripting payloads.

How to Mitigate CVE-2025-42956

Immediate Actions Required

Apply the SAP security patch referenced in SAP Note #3617131 to all affected SAP_BASIS releases from 700 through 816.
Review the SAP Security Patch Day advisory and prioritize remediation on internet-exposed NetWeaver systems.
Educate SAP users to avoid clicking untrusted links that reference internal SAP hostnames or contain unusual parameters.

Patch Information

SAP has released a corrective patch documented in SAP Note #3617131. Customers must authenticate to the SAP Support Portal to obtain the note and applicable Support Package or correction instructions for their SAP_BASIS release. All fifteen affected SAP_BASIS versions require the vendor-supplied fix; no downgrade path or partial mitigation replaces the official patch.

Workarounds

Restrict network exposure of SAP NetWeaver ABAP web endpoints to trusted networks via reverse proxy access control lists until the patch is applied.
Deploy a WAF policy in front of SAP application servers to filter reflected XSS payloads in request parameters.
Enforce Content Security Policy (CSP) headers at the reverse proxy or Web Dispatcher layer to restrict inline script execution.
Require multi-factor authentication for SAP GUI and Fiori sessions to limit the value of any stolen session token.

bash

# Example: SAP Web Dispatcher modification handler to add a restrictive CSP header
# Place in the modification file referenced by icm/HTTP/mod_0
SetHeader Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'self'"
SetHeader X-Content-Type-Options "nosniff"
SetHeader X-Frame-Options "SAMEORIGIN"