CVE-2025-42987: SAP Bank Statement Rules Auth Bypass Flaw

CVE-2025-42987 Overview

CVE-2025-42987 affects SAP Manage Processing Rules (For Bank Statement). The vulnerability allows an authenticated attacker with basic privileges to edit shared processing rules belonging to any user by tampering with a request parameter. The application fails to perform an authorization check on the target rule, letting the attacker modify records that should be restricted. Successful exploitation compromises the integrity of bank statement processing rules but does not expose data or affect availability. The issue is classified under CWE-862: Missing Authorization.

Critical Impact
Authenticated users with basic privileges can tamper with shared bank statement processing rules owned by other users, undermining the integrity of financial reconciliation logic.

Affected Products

SAP Manage Processing Rules (For Bank Statement)

Discovery Timeline

2025-06-10 - CVE-2025-42987 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-42987

Vulnerability Analysis

The flaw resides in the SAP Manage Processing Rules application used for bank statement reconciliation. The application accepts a request parameter that identifies the rule to be edited. It authenticates the caller but does not verify whether that caller owns the rule or has permission to modify it. An attacker holding only basic application privileges can substitute the identifier of a shared rule owned by another user and submit an edit request. The backend processes the modification without rejecting the operation.

The integrity impact is limited to rule content. Confidentiality and availability are not affected, since the operation does not read protected data or crash the service. However, tampered rules can steer bank statement processing to incorrect accounts, categories, or clearing logic, producing downstream financial errors.

Root Cause

The root cause is a missing server-side authorization check [CWE-862]. The application relies on client-supplied identifiers to select the target rule and does not re-validate ownership or role-based access on the server. This is a classic Insecure Direct Object Reference pattern layered over shared-object semantics.

Attack Vector

Exploitation requires network access to the SAP application and a valid low-privilege user account. No user interaction is required. The attacker intercepts a legitimate edit request, replaces the rule identifier with that of a shared rule owned by another user, and reissues the request. Because the server does not enforce authorization on the referenced object, the modification succeeds.

No public proof-of-concept has been released, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-42987

Indicators of Compromise

Unexpected modifications to shared bank statement processing rules attributed to low-privilege user accounts.
Application audit log entries showing rule edits where the acting user differs from the rule owner or a delegated approver.
HTTP requests to the Manage Processing Rules endpoints containing rule identifiers that the requesting user has not previously accessed.

Detection Strategies

Enable and review SAP application audit logging for the Manage Processing Rules (For Bank Statement) service, focusing on edit operations.
Correlate rule modification events with the requesting user's role assignments to flag unauthorized ownership boundaries.
Alert on high volumes of rule edits from a single non-administrative account within a short time window.

Monitoring Recommendations

Forward SAP security audit log (SM19/SM20) and change document data to a centralized SIEM for correlation.
Baseline normal rule-edit activity per user and role, then alert on deviations.
Monitor changes to financial reconciliation logic as part of the SOX or equivalent control set and require review before production impact.

How to Mitigate CVE-2025-42987

Immediate Actions Required

Apply the fix referenced in SAP Note #3596850 as prioritized by SAP Security Patch Day guidance.
Review recent modifications to shared bank statement processing rules and validate them against expected change control records.
Restrict access to the Manage Processing Rules application to users with a documented business need until patching is complete.

Patch Information

SAP addressed the missing authorization check in the patch distributed through SAP Note #3596850, released as part of SAP Security Patch Day. Administrators should apply the patch to all affected SAP systems and validate that authorization checks are enforced for shared rule modifications after installation.

Workarounds

Tighten role assignments so that only users required to manage processing rules retain edit privileges on the application.
Increase audit log retention and enable change tracking on processing rule objects to detect unauthorized edits pending patch deployment.
Require post-change review of shared rule modifications through an out-of-band approval process until the patch is applied.

bash

# Example: extract recent Manage Processing Rules edit events from SAP audit logs
# for out-of-band review. Adjust user, date, and transaction filters as needed.
RSAU_SELECT_EVENTS \
  --event-class=AUZ \
  --tcode=MANAGE_PROC_RULES \
  --from=YYYY-MM-DD \
  --to=YYYY-MM-DD \
  --output=/tmp/mpr_edits.csv