CVE-2025-30009
📋 TL;DR
This vulnerability in SAP SRM's Live Auction Cockpit allows unauthenticated attackers to execute malicious scripts in victims' browsers via a deprecated Java applet component. It affects organizations using the vulnerable SAP SRM packages, potentially enabling cross-site scripting attacks against users accessing the auction interface.
💻 Affected Systems
- SAP Supplier Relationship Management (SRM)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform actions as authenticated users, or redirect users to malicious sites, compromising user accounts and sensitive auction data.
Likely Case
Attackers inject malicious scripts to steal session tokens or user credentials, leading to unauthorized access to auction functionality and potential data theft.
If Mitigated
With proper browser security controls and network segmentation, impact is limited to isolated browser sessions without affecting backend systems.
🎯 Exploit Status
Exploitation requires tricking users into accessing malicious content via the vulnerable component.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version specified in SAP Note 3578900
Vendor Advisory: https://me.sap.com/notes/3578900
Restart Required: Yes
Instructions:
1. Apply SAP Security Note 3578900. 2. Restart affected SAP systems. 3. Verify Java applet components are removed from Live Auction Cockpit.
🔧 Temporary Workarounds
Disable Java Applets in Browsers
allConfigure browsers to block Java applet execution globally.
Network Segmentation
allRestrict access to SAP SRM Live Auction Cockpit to trusted networks only.
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block malicious script injection patterns.
- Disable or restrict access to the Live Auction Cockpit component entirely.
🔍 How to Verify
Check if Vulnerable:
Check if SAP SRM version matches affected versions in SAP Note 3578900 and if Live Auction Cockpit uses Java applets.Check Version:
Use SAP transaction SPAM to check applied notes or system version.Verify Fix Applied:
Verify SAP Note 3578900 is applied and Java applet components are no longer present in Live Auction Cockpit.📡 Detection & Monitoring
Log Indicators:
- Unusual Java applet load attempts in SAP logs
- Multiple failed authentication attempts from single IPs
Network Indicators:
- HTTP requests to Java applet resources in Live Auction Cockpit
- Unexpected script injection patterns
SIEM Query:
Search for 'Live Auction Cockpit' AND 'java applet' in web access logs with suspicious parameters.