CVE-2025-42974: Missing Authorization Check Auth Bypass Flaw

CVE-2025-42974 Overview

CVE-2025-42974 is a missing authorization vulnerability affecting an SAP remote-enabled function module. An attacker authenticated as a non-administrative user can invoke the function module and access information that should be restricted. The flaw is classified under CWE-862: Missing Authorization and impacts confidentiality only, with no impact on integrity or availability. SAP published the advisory as part of its Security Patch Day process.

Critical Impact
Authenticated low-privileged users can retrieve restricted information through a remote-enabled function module that fails to enforce authorization checks.

Affected Products

SAP product identified in SAP Note #3610056 (specific components not disclosed in NVD data)
Deployments exposing the affected remote-enabled function module via Remote Function Call (RFC)
Systems referenced in the SAP Security Patch Day Announcement

Discovery Timeline

2025-07-08 - CVE-2025-42974 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-42974

Vulnerability Analysis

The vulnerability resides in a remote-enabled function module (RFM) within an SAP product. RFMs are ABAP function modules exposed over the Remote Function Call (RFC) protocol, allowing external callers and internal SAP components to invoke server-side logic. When properly implemented, an RFM enforces AUTHORITY-CHECK statements to validate that the calling user has the required authorization objects before returning data.

In this case, the function module omits or improperly performs that authorization check. A non-administrative user with a valid SAP session can call the module through standard RFC clients and receive data intended for privileged roles. The impact is limited to information disclosure, which aligns with the low confidentiality-only impact rating.

Root Cause

The root cause is a missing authorization check [CWE-862]. The affected RFM does not verify that the caller holds the authorization object required to access the underlying data. SAP has not publicly disclosed the specific module name or authorization object in the public advisory.

Attack Vector

Exploitation requires network access to the SAP system and valid, low-privileged credentials. No user interaction and no elevated privileges are needed. An attacker uses a standard RFC-capable client, such as an SAP GUI, an RFC SDK program, or a custom script, to invoke the vulnerable function module. Because no synthetic proof-of-concept has been released, defenders should reference SAP Note #3610056 for module identification and remediation details.

Detection Methods for CVE-2025-42974

Indicators of Compromise

Unexpected RFC calls from non-administrative user accounts to sensitive function modules recorded in SAP Security Audit Log (SM19/SM20).
Access patterns where standard business users invoke administrative or reporting function modules outside normal workflow context.
Unusual data export volumes tied to RFC sessions originating from low-privileged accounts.

Detection Strategies

Enable and review the SAP Security Audit Log for RFC function module calls, focusing on modules referenced in SAP Note #3610056.
Correlate RFC gateway logs with user role assignments to identify calls that bypass expected authorization boundaries.
Use SAP Read Access Logging (RAL) to record access to sensitive data returned by remote function modules.

Monitoring Recommendations

Forward SAP audit logs and RFC gateway logs to a centralized SIEM for correlation and long-term retention.
Baseline normal RFC caller-to-module patterns per user role and alert on deviations.
Monitor for the creation of new RFC destinations or trusted RFC relationships that could be abused to reach the vulnerable module.

How to Mitigate CVE-2025-42974

Immediate Actions Required

Apply the SAP patch referenced in SAP Note #3610056 to affected systems.
Inventory SAP systems using the SAP Security Patch Day process and prioritize internet-adjacent or multi-tenant instances.
Review role assignments for non-administrative users and remove excessive RFC access where feasible.

Patch Information

SAP addressed CVE-2025-42974 through the fix distributed via SAP Note #3610056, released as part of the SAP Security Patch Day. Administrators must authenticate to the SAP ONE Support Launchpad to download the corresponding support package or correction instructions.

Workarounds

Restrict RFC access to the vulnerable function module using SAP Unified Connectivity (UCON) to allow only required client applications.
Tighten authorization profiles so non-administrative users cannot execute the affected function group.
Limit network exposure of the SAP RFC gateway to trusted management networks until patching is complete.

bash

# UCON RFC allowlist example: activate UCON and review the runtime check
# Transaction: UCONCOCKPIT
# 1. Activate scenario RFC Basic Scenario
# 2. Move required function modules to the Communication Assembly
# 3. Block all modules not explicitly assigned