Server-Side Request Forgery in SAP Business Objects Business Intelligence Platform

The primary impact of CVE-2025-42988 is information disclosure. An attacker can use the vulnerability to discover internal HTTP endpoints that are not normally exposed to the outside world. This reconnaissance can then be used to launch SSRF attacks, potentially allowing the attacker to access internal resources, interact with internal APIs, or even trigger actions on internal systems. While the vulnerability itself doesn't allow for direct data modification or denial of service, the SSRF component could be exploited to achieve those outcomes depending on the internal services exposed. The lack of authentication required to exploit the vulnerability significantly broadens the potential attack surface.

Organizations utilizing SAP Business Objects Business Intelligence Platform, particularly those with complex internal network architectures and limited network segmentation, are at increased risk. Shared hosting environments where multiple tenants share the same infrastructure could also be vulnerable if the platform is deployed in a multi-tenant configuration.

• java / server:

# Monitor access logs for requests to internal endpoints originating from the SAP Business Objects platform.
# Example (assuming Apache access logs): grep "SAP Business Objects" /var/log/apache2/access.log | grep "internal_endpoint"

• generic web:

# Use curl to probe for potential internal endpoints.  This is a manual check, not automated.
curl -v http://<SAP_Business_Objects_IP>/internal_endpoint

1. 2025-06-10Disclosure

   disclosure

1. Reserviert2025-04-16
2. Veröffentlicht2025-06-10
3. EPSS aktualisiert2026-03-23

The recommended mitigation for CVE-2025-42988 is to upgrade to SAP Business Objects Business Intelligence Platform version 430.0.1 or later. Prior to upgrading, it's crucial to review SAP's official upgrade documentation and perform thorough testing in a non-production environment to ensure compatibility and avoid any disruption to business operations. As a temporary workaround, consider implementing strict network segmentation to limit access to internal resources from the Business Objects platform. Web Application Firewalls (WAFs) can be configured to filter HTTP requests and block those attempting to enumerate endpoints. Monitor network traffic for unusual outbound connections originating from the Business Objects server.