SAP SRM – Blind XXE in /srm/messaging
Impact on Business
A remote, unauthenticated attacker can exploit this vulnerability to read arbitrary files from the file system of the application server. This has a high impact on the confidentiality of the system, potentially exposing sensitive business data, credentials, and system configurations. Additionally, it allows the attacker to perform Server-Side Request Forgery (SSRF) attacks, which could be used to pivot to other internal systems.
Vulnerability Details
A specific servlet in SAP SRM processes XML input without properly restricting external entity references. An unauthenticated attacker can send specially crafted XML requests that cause the XML parser to resolve external entities. Although the responses do not directly reflect the loaded data (Blind XXE), an attacker can still leverage out-of-band techniques to exfiltrate sensitive file contents or perform Server-Side Request Forgery (SSRF) attacks against internal network resources.
Solution
SAP has released SAP Note 3578900 which provides patched versions of the affected components.
The patches can be downloaded from https://me.sap.com/notes/3578900.
Onapsis strongly recommends SAP customers to download the related security fixes and apply them to the affected components in order to reduce business risks.
Report Timeline
- 11/22/2024: Onapsis reports vulnerability to SAP
- 05/13/2025: SAP issues the patch
References
Advisory Information
- Public Release Date: 07/30/2026
- Security Advisory ID: ONAPSIS-2026-0031
- Researcher(s): Yvan Genuer
Vulnerability Information
- Vendor: SAP
- Affected Components: SAP Supplier Relationship Management (SAP SRM) (Check SAP Note 3578900 for detailed information on affected releases)
- Vulnerability Class: CWE-611: Improper Restriction of XML External Entity Reference
- CVSS v3 score: 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N)
- Risk Level: High
- Assigned CVE: CVE-2025-30018
- Vendor patch Information: SAP Security NOTE 3578900
Affected Components Description
The vulnerability affects SAP Supplier Relationship Management (SAP SRM) 7.0 EHP4, specifically impacting the Java components associated with the application.
About our Research Labs
Onapsis Research Labs provides the industry analysis of key security issues that impact mission-critical systems and applications. Delivering frequent and timely security and compliance advisories with associated risk levels, Onapsis Research Labs combine in-depth knowledge and experience to deliver technical and business-context with sound security judgment to the broader information security community.
Find all reported vulnerabilities at: https://github.com/Onapsis/vulnerability_advisories
This advisory is licensed under a Creative Commons 4.0 BY-ND International License