CVE-2025-42984: SAP S/4HANA Authorization Bypass Vulnerability

CVE-2025-42984 Overview

CVE-2025-42984 affects the SAP S/4HANA Manage Central Purchase Contract application. The application fails to perform required authorization checks for authenticated users. An attacker with low-privilege access can execute a function import on a targeted entity. This action renders the entity inaccessible to unrestricted users, disrupting normal purchase contract operations.

The flaw is categorized as a Missing Authorization vulnerability [CWE-862]. It affects the confidentiality and availability of the application at a low level. Integrity remains unaffected. The vulnerability is exploitable over the network without user interaction, requiring only valid authentication.

Critical Impact
An authenticated attacker can invoke restricted function imports on purchase contract entities, causing denial of service for legitimate users and exposing limited business data.

Affected Products

SAP S/4HANA (Manage Central Purchase Contract)
SAP Fiori applications exposing the affected OData function imports
SAP systems tracked under SAP Note #3441087

Discovery Timeline

2025-06-10 - CVE-2025-42984 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-42984

Vulnerability Analysis

The Manage Central Purchase Contract component exposes OData function imports without validating that the calling user holds the required authorization objects. Any authenticated user in the SAP S/4HANA system can invoke these function imports against purchase contract entities.

The outcome is that entities can be placed into states or acted upon in ways that make them inaccessible to users who would normally have full rights. This impacts business continuity for procurement workflows. Confidentiality is affected because unauthorized users receive responses containing contract metadata they should not see.

The defect falls under Missing Authorization [CWE-862]. SAP's authorization framework, which typically enforces object-level checks through AUTHORITY-CHECK statements or Fiori launchpad role validation, is not invoked at the entry point of the affected function import handlers.

Root Cause

The root cause is the absence of authorization checks in the request handling logic for specific function imports within the Manage Central Purchase Contract service. Developers did not enforce the S_TCODE or contract-specific authorization objects on these entry points. As a result, session authentication is treated as sufficient for privileged operations.

Attack Vector

Exploitation requires the attacker to hold a valid SAP S/4HANA account. The attacker sends a crafted OData request to the affected function import endpoint of the Manage Central Purchase Contract service. The server processes the request and applies the operation to the target entity without evaluating whether the user is authorized.

No user interaction is needed on the victim side. The attack does not require elevated privileges beyond baseline authenticated access. Refer to the SAP Note #3441087 for the affected endpoints and vulnerable component paths.

Detection Methods for CVE-2025-42984

Indicators of Compromise

OData function import calls to Manage Central Purchase Contract endpoints originating from user accounts that lack procurement role assignments.
Purchase contract entities entering unexpected states without corresponding authorized change records in SAP Change Documents (CDHDR/CDPOS).
Help desk reports from procurement users unable to open or modify central purchase contracts that were previously accessible.

Detection Strategies

Audit SAP Gateway logs (/IWFND/TRACES, /IWBEP/TRACES) for function import invocations against the Manage Central Purchase Contract service by non-procurement users.
Correlate SAP Security Audit Log (SM20) entries with the affected OData service path to identify anomalous authenticated access patterns.
Review role-to-user assignments in PFCG and compare against actual function import usage to surface accounts operating outside their assigned scope.

Monitoring Recommendations

Forward SAP Gateway and Security Audit Log events to a centralized SIEM for continuous review of privileged OData operations.
Alert on spikes in failed or unusual purchase contract state transitions per user account.
Track SAP Note #3441087 patch deployment status across all S/4HANA production and non-production tenants.

How to Mitigate CVE-2025-42984

Immediate Actions Required

Apply the SAP patch referenced in SAP Note #3441087 to all affected S/4HANA systems.
Review PFCG role assignments for the Manage Central Purchase Contract application and remove access from users who do not require it.
Enable and monitor the SAP Security Audit Log for the affected OData service to identify prior exploitation attempts.

Patch Information

SAP published the corrective note on SAP Security Patch Day. Administrators should download and apply SAP Note #3441087 through the SAP ONE Support Launchpad. Full details and the current fix version list are available in the SAP Security Patch Day portal.

Workarounds

Restrict access to the Manage Central Purchase Contract Fiori tile through catalog and group assignment until the patch is applied.
Disable the affected OData function imports at the SAP Gateway service level using /IWFND/MAINT_SERVICE where operationally feasible.
Enforce network-level restrictions so that only trusted client networks can reach the SAP Gateway OData endpoints.

bash

# Configuration example: restrict OData service access via SAP Gateway
# Transaction: /IWFND/MAINT_SERVICE
# 1. Select the Manage Central Purchase Contract service
# 2. Choose 'Service Groups Assignment' and limit to required groups
# 3. Use 'Soft State Administration' to disable exposed function imports
# 4. Apply SAP Note #3441087 via SNOTE as the permanent fix