CVE-2025-42999
📋 TL;DR
CVE-2025-42999 is a deserialization vulnerability in SAP NetWeaver Visual Composer Metadata Uploader that allows privileged users to upload malicious content, potentially leading to remote code execution. This affects SAP systems with the vulnerable component enabled. Attackers could compromise the confidentiality, integrity, and availability of the host system.
💻 Affected Systems
- SAP NetWeaver Visual Composer
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with remote code execution, data exfiltration, and persistent backdoor installation
Likely Case
Privilege escalation leading to unauthorized access to sensitive business data and system manipulation
If Mitigated
Limited impact with proper access controls and monitoring, potentially only affecting non-critical components
🎯 Exploit Status
Exploitation requires privileged user credentials; similar SAP vulnerabilities have been actively exploited
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply SAP Security Note 3604119
Vendor Advisory: https://me.sap.com/notes/3604119
Restart Required: Yes
Instructions:
1. Download SAP Security Note 3604119 from SAP Support Portal
2. Apply the note using SAP Note Assistant or transaction SNOTE
3. Restart affected SAP systems
4. Verify the patch is applied correctly
🔧 Temporary Workarounds
Restrict Access to Visual Composer
allLimit access to the Visual Composer Metadata Uploader component to only essential users
Implement Input Validation
allAdd additional validation for uploaded metadata files before processing
🧯 If You Can't Patch
- Implement strict access controls to limit privileged user access to the vulnerable component
- Monitor and audit all metadata upload activities for suspicious patterns
🔍 How to Verify
Check if Vulnerable:
Check if SAP Security Note 3604119 is applied using transaction SNOTE or check system version against affected versions in SAP advisoryCheck Version:
Use SAP transaction SM51 or check system information in SAP GUIVerify Fix Applied:
Verify SAP Note 3604119 is successfully applied and no errors in system logs related to Visual Composer📡 Detection & Monitoring
Log Indicators:
- Unusual metadata upload activities
- Errors in Visual Composer logs
- Privileged user accessing upload functionality outside normal patterns
Network Indicators:
- Unusual traffic to Visual Composer endpoints
- Large metadata file uploads
SIEM Query:
source="sap_logs" AND (event="metadata_upload" OR component="visual_composer") AND user="privileged_user"