CVE-2025-42985: SAP BusinessObjects XSS Vulnerability

CVE-2025-42985 Overview

CVE-2025-42985 is a reflected cross-site scripting (XSS) vulnerability in the SAP BusinessObjects Content Administrator Workbench. Insufficient input sanitization allows attackers to craft malicious URLs that execute arbitrary scripts in a victim's browser session. Successful exploitation requires user interaction, such as clicking a crafted link. The flaw is categorized under [CWE-601] and carries a CVSS 3.1 base score of 6.1. Exploitation can expose or modify web client data, resulting in limited impact on confidentiality and integrity, with no impact on availability. SAP published the fix as part of its monthly Security Patch Day release.

Critical Impact
Attackers can execute arbitrary JavaScript in an authenticated user's browser, enabling theft of session data or manipulation of client-side content within the SAP BusinessObjects Content Administrator Workbench.

Affected Products

SAP BusinessObjects Content Administrator Workbench
SAP BusinessObjects Business Intelligence Platform (component containing the Content Administrator Workbench)
Refer to SAP Note #3617380 for the complete list of affected releases

Discovery Timeline

2025-07-08 - CVE-2025-42985 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-42985

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the SAP BusinessObjects Content Administrator Workbench. User-supplied parameters passed through URLs are reflected back into HTTP responses without adequate sanitization or output encoding. An attacker can embed JavaScript within a crafted URL, and when a victim opens that URL, the injected script executes in the security context of the SAP application.

Because the scope metric changes when the payload executes, the attacker's script can affect resources beyond the initially vulnerable component. This includes reading cookies, session tokens, and Document Object Model (DOM) content, or modifying rendered pages within the victim's browser. Exploitation requires user interaction, typically delivered via phishing or a malicious link embedded in trusted content.

Root Cause

The root cause is missing or insufficient input sanitization and output encoding in URL parameters handled by the Content Administrator Workbench. The application reflects untrusted input directly into HTML responses, violating standard [CWE-601] and XSS mitigation practices.

Attack Vector

The attack vector is network-based and requires no authentication. An attacker crafts a URL containing a JavaScript payload targeting a vulnerable Content Administrator Workbench endpoint. The attacker delivers the URL through email, chat, or a compromised web page. When an authenticated victim clicks the link, the browser executes the payload in the SAP application's origin.

No verified public proof-of-concept code is available. The exploitation pattern follows standard reflected XSS delivery: a crafted query string parameter containing script content that renders unescaped in the server response.

Detection Methods for CVE-2025-42985

Indicators of Compromise

HTTP requests to SAP BusinessObjects Content Administrator Workbench endpoints containing script tags, javascript: URIs, or event handler attributes (e.g., onerror=, onload=) in query parameters
Web server or reverse proxy logs showing URL parameters with encoded payloads such as %3Cscript%3E or %3Csvg
Referrer headers pointing to unknown external domains preceding suspicious requests to BusinessObjects URLs

Detection Strategies

Deploy web application firewall (WAF) rules to identify reflected XSS patterns in requests targeting SAP BusinessObjects paths
Correlate authenticated user sessions with anomalous outbound requests from browsers immediately after visiting BusinessObjects URLs
Review browser Content Security Policy (CSP) violation reports for blocked inline script execution originating from the workbench

Monitoring Recommendations

Monitor SAP BusinessObjects access logs for unusually long query strings or HTML/JavaScript metacharacters in parameters
Alert on user reports of unexpected redirects, popups, or authentication prompts within the Content Administrator Workbench
Track email gateway telemetry for links referencing SAP BusinessObjects hostnames combined with encoded script payloads

How to Mitigate CVE-2025-42985

Immediate Actions Required

Apply the security fix documented in SAP Note #3617380 to all affected SAP BusinessObjects installations
Review the SAP Security Patch Day Update for the applicable patch level and prerequisites
Restrict access to the Content Administrator Workbench to trusted administrators using network segmentation
Educate administrators to avoid clicking untrusted links to SAP BusinessObjects URLs

Patch Information

SAP released a fix as part of Security Patch Day. Administrators should consult SAP Note #3617380 for version-specific patch guidance and installation instructions. Applying the patch replaces the vulnerable request handling logic with proper input validation and output encoding.

Workarounds

Deploy a WAF rule set that blocks requests containing script tags, javascript: URIs, or common XSS payload patterns targeting BusinessObjects endpoints
Enforce a strict Content Security Policy (CSP) that disallows inline scripts and restricts script sources on the SAP BusinessObjects domain
Limit Content Administrator Workbench exposure to internal networks or VPN-only access until patching is complete

bash

# Example WAF rule (ModSecurity) to block reflected XSS payloads on BusinessObjects paths
SecRule REQUEST_URI "@contains /BOE/" \
    "chain,phase:2,deny,status:403,id:1000042,\
    msg:'Potential XSS targeting SAP BusinessObjects Content Administrator Workbench (CVE-2025-42985)'"
    SecRule ARGS "@rx (?i)(<script|javascript:|onerror\s*=|onload\s*=|<svg)" \
        "t:none,t:urlDecodeUni"