SAP S/4HANA 和 SAP SCM (特征传播) 中的代码注入漏洞

The impact of CVE-2025-42967 is severe. Successful exploitation allows an attacker to execute arbitrary code on the affected SAP system with user privileges. This can lead to complete system takeover, enabling the attacker to access, modify, or delete sensitive data, install malware, or disrupt critical business operations. The ability to create a custom report with malicious code provides a highly effective attack vector, bypassing standard security controls. Given the widespread use of SAP systems in critical infrastructure and enterprise environments, the potential blast radius of this vulnerability is significant. This vulnerability shares similarities with other SAP RCE vulnerabilities where report customization features are exploited to gain unauthorized access and control.

Organizations heavily reliant on SAP S/4HANA and SAP SCM for critical business processes are at significant risk. This includes industries such as manufacturing, finance, and supply chain management. Systems with legacy configurations or those lacking robust access controls are particularly vulnerable. Shared hosting environments utilizing older SAP versions also present a heightened risk.

• linux / server:

journalctl -u <sap_service_name> | grep -i "characteristic propagation"

• generic web:

curl -I <sap_url>/sap/bc/ui2/ui2/browser?sap-client=<client_id>&fiori=/sap/ui2/view/main.html

• database (mysql):

SELECT * FROM <sap_tables> WHERE <column_name> LIKE '%characteristic propagation%';

1. 2025-07-08Disclosure

   disclosure

1. 已保留2025-04-16
2. 发布日期2025-07-08
3. 修改日期2026-02-26
4. EPSS 更新日期2026-03-23

The primary mitigation for CVE-2025-42967 is to upgrade to a patched version of SAP S/4HANA and SAP SCM. Refer to the official SAP security note for the specific fixed version. If immediate patching is not possible, consider implementing temporary workarounds such as restricting user privileges related to report creation and modification. Implement strict input validation on any user-supplied data used in report generation. Monitor SAP system logs for suspicious activity related to report creation and execution. After upgrading, confirm the fix by attempting to create a report with potentially malicious code and verifying that the system prevents its execution.