CVE-2025-43011: SAP Landscape Transformation Auth Bypass

CVE-2025-43011 Overview

CVE-2025-43011 is a missing authorization vulnerability [CWE-862] in the PCL Basis module of SAP Landscape Transformation (SLT). Under specific conditions, the module fails to enforce required authorization checks. Authenticated users can leverage this gap to access restricted functionalities or data outside their assigned permissions.

The flaw produces a high impact on confidentiality, with no effect on integrity or availability. The scope is changed, meaning a successful attack affects resources beyond the vulnerable component. SAP released a fix through its monthly Security Patch Day process.

Critical Impact
Authenticated attackers with low privileges can access restricted SAP Landscape Transformation data across security boundaries without user interaction.

Affected Products

SAP Landscape Transformation (SLT)
PCL Basis module (component shipped with SLT)
Refer to SAP Note #3591978 for the list of fixed support package levels

Discovery Timeline

2025-05-13 - CVE-2025-43011 published to the National Vulnerability Database
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-43011

Vulnerability Analysis

The vulnerability resides in the PCL Basis module bundled with SAP Landscape Transformation. The module exposes functions that operate on landscape transformation data, including replication objects and configuration entities. Under certain runtime conditions, the module skips the authorization checks that should validate the caller's role and permissions.

Because SAP Landscape Transformation orchestrates data replication between SAP systems, the PCL Basis module typically processes business data crossing system boundaries. A missing authorization check at this layer exposes data that the authenticated user is otherwise restricted from viewing. The changed scope reflects that a successful request affects information governed by a security authority different from the vulnerable component.

Root Cause

The root cause is a missing authorization check [CWE-862]. The PCL Basis module invokes functionality without first verifying that the caller holds the SAP authorization objects required for the requested operation. The control gap is conditional, meaning specific call paths or input states bypass the authorization layer rather than every invocation.

Attack Vector

The attack vector is network-based and requires an authenticated SAP user with low privileges. No user interaction is required. An attacker submits crafted requests to the SLT system through standard SAP communication channels such as Remote Function Call (RFC), SAP GUI dialog steps, or web-based interfaces that reach the PCL Basis module. The lack of an authorization check returns restricted data to the attacker's session.

No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See SAP Note #3591978 for the authoritative technical description.

Detection Methods for CVE-2025-43011

Indicators of Compromise

Unexpected RFC or dialog calls to PCL Basis function modules from low-privileged SAP user accounts
SLT replication or configuration data accessed by users outside the SLT administrator role pool
Security Audit Log (SM20) entries showing function execution without matching authorization trace events
Spikes in successful access to landscape transformation objects from non-administrative business users

Detection Strategies

Enable the SAP Security Audit Log and capture RFC function calls, transaction starts, and successful logons for SLT users
Run authorization trace (ST01 / STAUTHTRACE) on the SLT system to baseline which authorization objects PCL Basis functions should require
Correlate SLT application logs with user role assignments to flag accesses that bypass expected role gates
Forward SAP logs to a centralized analytics platform and alert on anomalous user-to-function pairings

Monitoring Recommendations

Continuously monitor PCL Basis function module invocations and flag callers without the relevant S_RFC and SLT-specific authorization objects
Track changes to user role assignments granting SLT access and review them against change management tickets
Alert on read access to replication configuration tables by accounts that are not part of the SLT operations team

How to Mitigate CVE-2025-43011

Immediate Actions Required

Apply the SAP-provided fix referenced in SAP Note #3591978 on all SLT systems
Inventory every SAP Landscape Transformation system, including non-production environments, and confirm patch coverage
Review current SLT and PCL Basis authorizations and remove access from users who do not require it
Audit recent Security Audit Log entries for evidence of unauthorized access prior to patching

Patch Information

SAP published the fix as part of its monthly Security Patch Day. Customers must download and apply the support package or correction instructions described in SAP Note #3591978. Refer to the SAP Security Patch Day portal for the corresponding patch level on each supported SLT release.

Workarounds

No vendor-provided workaround replaces the patch; install the SAP Note as the primary remediation
Restrict network access to the SLT system so only authorized administrative hosts can reach PCL Basis interfaces
Tighten role design to apply least privilege for SLT users until the patch is deployed
Increase Security Audit Log retention and review frequency during the remediation window

bash

# Example: enable SAP Security Audit Log filters for SLT users via SM19/RSAU_CONFIG
# Activate audit for successful and failed RFC calls and transaction starts
# Filter 1: User group = SLT_USERS, Client = *, Events = AU1, AU2, AUK, AUM, AUO, AUP
# After activation, review log entries via SM20 / RSAU_READ_LOG