CVE-2025-42981: SAP NetWeaver ABAP XSS Vulnerability

CVE-2025-42981 Overview

CVE-2025-42981 is an open redirect vulnerability [CWE-601] in SAP NetWeaver Application Server ABAP. An unauthenticated attacker can craft a URL that embeds a malicious script at a location not properly sanitized by the server. When a victim clicks the crafted link, the script executes in the victim's browser and redirects the session to an attacker-controlled site.

Successful exploitation lets attackers access or modify restricted information tied to the web client. The flaw affects confidentiality and integrity of the client session but does not impact availability. Exploitation requires user interaction, and the scope changes because the browser context executes outside the vulnerable component.

Critical Impact
Unauthenticated attackers can hijack SAP NetWeaver ABAP user sessions through crafted redirect URLs, exposing confidential business data and enabling phishing against authenticated SAP users.

Affected Products

SAP NetWeaver Application Server ABAP
Specific supported release versions listed in SAP Note #3617131
Web-facing ABAP components processing redirect parameters

Discovery Timeline

2025-07-08 - CVE-2025-42981 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-42981

Vulnerability Analysis

The vulnerability resides in a URL handling routine within SAP NetWeaver Application Server ABAP that fails to validate or sanitize a redirect target parameter. The server accepts an externally supplied destination and reflects it into a client-side navigation directive without enforcing an allow-list of trusted origins.

Because the redirect target is user-controlled, an attacker can point the parameter to an arbitrary site or embed script content that executes in the victim's browser session. The scope-change property indicates that the payload executes in a security context different from the vulnerable ABAP component, extending impact to the user's browser session and any tokens accessible within it.

Exploitation does not require authentication on the attacker's side, but the victim must interact with the crafted URL. Impact to confidentiality and integrity is bounded to information tied to the affected web client rather than the SAP backend.

Root Cause

The root cause is insufficient validation of a URL redirect parameter. The ABAP handler accepts external input as a redirect target without comparing it to a whitelist of approved hosts or stripping active script content. This design gap maps directly to CWE-601 (URL Redirection to Untrusted Site).

Attack Vector

An attacker constructs a URL pointing to a legitimate SAP NetWeaver ABAP endpoint that contains a vulnerable redirect parameter. The attacker delivers the URL through phishing email, chat, or a compromised web page. When an authenticated SAP user clicks the link, the ABAP server processes the request and drives the browser toward the attacker's destination or executes the embedded script under the SAP origin, allowing theft of session data or presentation of a spoofed login page.

No verified public exploit code is available. See SAP Note #3617131 for vendor-supplied technical detail.

Detection Methods for CVE-2025-42981

Indicators of Compromise

Web server access logs containing redirect parameters pointing to external, non-SAP hostnames or containing URL-encoded javascript:, data:, or %2F%2F sequences.
Referrer chains showing SAP NetWeaver ABAP endpoints handing users off to unrelated domains during authenticated sessions.
User reports of unexpected login prompts or redirects immediately after clicking links to internal SAP resources.

Detection Strategies

Inspect ICM and Web Dispatcher logs for HTTP requests carrying redirect query parameters with absolute URLs, protocol-relative URLs, or encoded script schemes.
Deploy web application firewall rules that flag redirect parameters containing external hostnames on SAP NetWeaver ABAP endpoints.
Correlate email gateway telemetry with URL click events to identify phishing campaigns targeting SAP users with crafted NetWeaver links.

Monitoring Recommendations

Enable HTTP request logging on all internet-facing SAP NetWeaver ABAP instances and forward the logs to a central analytics platform for anomaly analysis.
Alert on outbound HTTP 302 responses from ABAP servers where the Location header targets a domain outside the approved SAP infrastructure list.
Review browser security telemetry for cross-origin navigations initiated from SAP NetWeaver hostnames.

How to Mitigate CVE-2025-42981

Immediate Actions Required

Apply the security fix referenced in SAP Note #3617131 on all SAP NetWeaver Application Server ABAP systems.
Review the SAP Security Patch Day advisory for the associated release schedule and dependent notes.
Restrict direct internet exposure of SAP NetWeaver ABAP endpoints where feasible and place them behind a reverse proxy that validates redirect parameters.

Patch Information

SAP has released the corrective code through SAP Note #3617131. Customers should download the note, identify the applicable Support Package or correction instruction for their release, and apply it through SNOTE or the standard support package process. Validate the fix in a non-production environment before rolling it out to production ABAP systems.

Workarounds

Configure Web Dispatcher or a reverse proxy rule to reject requests where redirect parameters contain absolute URLs, protocol-relative URLs, or script schemes.
Enforce a strict Content-Security-Policy response header on SAP NetWeaver ABAP responses to limit script execution contexts in the client browser.
Conduct targeted user awareness communication warning SAP users against clicking unexpected SAP URLs received through external channels until the patch is deployed.

bash

# Example reverse-proxy filter to block external redirect targets
# (adapt to your Web Dispatcher / NGINX / Apache configuration)
if ($arg_redirectUrl ~* "^(https?:)?//(?!your-sap-domain\.example\.com)") {
    return 400;
}