SAP NetWeaver AS ABAP Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(242117);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/07/15");

  script_cve_id("CVE-2025-42956", "CVE-2025-42961", "CVE-2025-42981");
  script_xref(name:"IAVA", value:"2025-A-0505");

  script_name(english:"SAP NetWeaver AS ABAP Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"The remote SAP NetWeaver ABAP server may be affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The remote SAP NetWeaver ABAP server may be affected by multiple vulnerabilies.

  - SAP NetWeaver Application Server ABAP and ABAP Platform allows an unauthenticated attacker to create a 
    malicious link which they can make publicly available. When an authenticated victim clicks on this 
    malicious link, injected input data will be used by the web site page generation to create content which 
    when executed in the victim's browser leading to low impact on Confidentiality and Integrity with no effect on Availability of the application. (CVE-2025-42956)

  - Due to a missing authorization check in SAP NetWeaver Application server for ABAP, an authenticated user 
    with high privileges could exploit the insufficient validation of user permissions to access sensitive 
    database tables. By leveraging overly permissive access configurations, unauthorized reading of critical 
    data is possible, resulting in a significant impact on the confidentiality of the information stored. 
    However, the integrity and availability of the system remain unaffected. (CVE-2025-42961)

  - Due to an open redirect vulnerability in SAP NetWeaver Application Server ABAP, an unauthenticated 
    attacker could craft a URL link embedding a malicious script at a location not properly sanitized. When a 
    victim clicks on this link, the script executes within the victim's browser, redirecting them to a site 
    controlled by the attacker. This allows the attacker to access and/or modify restricted information 
    related to the web client. While the vulnerability poses no impact on data availability, it presents a 
    considerable risk to confidentiality and integrity. (CVE-2025-42981)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://support.sap.com/en/my-support/knowledge-base/security-notes-news/july-2025.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?689b7591");
  script_set_attribute(attribute:"see_also", value:"https://me.sap.com/notes/3617131");
  script_set_attribute(attribute:"see_also", value:"https://me.sap.com/notes/3610322");
  script_set_attribute(attribute:"solution", value:
"Apply the appropriate patch according to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-42981");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/07/08");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/07/08");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/07/15");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:sap:netweaver_application_server");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Web Servers");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("sap_netweaver_as_web_detect.nbin");
  script_require_keys("installed_sw/SAP Netweaver Application Server (AS)", "Settings/ParanoidReport");
  script_require_ports("Services/www", 80, 443, 8000, 50000);

  exit(0);
}

include('vcf_extras_sap.inc');

var app_info = vcf::sap_netweaver_as::get_app_info();

if (report_paranoia < 2)
  audit(AUDIT_PARANOID);


var constraints = [
  {'equal': '700', 'fixed_display': 'SAPKB70043' },
  {'equal': '701', 'fixed_display': 'SAPKB70128' },	
  {'equal': '702', 'fixed_display': 'SAPKB70228' },	
  {'equal': '731', 'fixed_display': 'SAPKB73137' },	
  {'equal': '740', 'fixed_display': 'SAPKB74034' },	
  {'equal': '750', 'fixed_display': 'SAPK-75033INSAPBASIS' },	
  {'equal': '751', 'fixed_display': 'SAPK-75121INSAPBASIS' },	
  {'equal': '752', 'fixed_display': 'SAPK-75217INSAPBASIS' },	
  {'equal': '753', 'fixed_display': 'SAPK-75315INSAPBASIS' },	
  {'equal': '754', 'fixed_display': 'SAPK-75413INSAPBASIS' },	
  {'equal': '755', 'fixed_display': 'SAPK-75511INSAPBASIS' },	
  {'equal': '756', 'fixed_display': 'SAPK-75609INSAPBASIS' },	
  {'equal': '757', 'fixed_display': 'SAPK-75707INSAPBASIS' },	
  {'equal': '758', 'fixed_display': 'SAPK-75805INSAPBASIS' },	
  {'equal': '816', 'fixed_display': 'SAPK-81601INSAPBASIS' }
];

vcf::sap_netweaver_as::check_version_and_report(
  app_info:app_info,
  constraints:constraints,
  severity:SECURITY_WARNING,
  abap:TRUE
);