Patch CVE-2025-42937 Now: SAP Print Service Directory Traversal Risk

Giulia Ferrari breaks down what you need to know

As SAP professionals, you know the drill: patch days come and go. But CVE-2025-42937 in SAP Print Service? With a CVSS score of 9.8, this directory traversal flaw isn’t just another note in the security bulletin—it’s a remote, unauthenticated ticket to your server’s file system. In my 12 years bridging AI innovation and enterprise security, I’ve seen overlooked services like Print Service turn into gateways for breaches that cascade into HANA data lakes or AI model repositories. If your systems expose printing endpoints externally, act today.

The Real Story

Directory traversal vulnerabilities let attackers navigate outside intended directories using sequences like ../. Here, SAP Print Service mishandles input, allowing remote foes to read arbitrary files—think SAP profiles, passwords, or even custom AI config scripts.

The CVSS 9.8 breaks down like this:

• Attack Vector: Network – No local access needed.
• Attack Complexity: Low – Basic HTTP requests suffice.
• Privileges: None – Unauthenticated exploit.
• User Interaction: None – Fully remote.
• Confidentiality: High – File dumps galore.
• Integrity/Availability: High – Potential for overwrites or DoS.

From the October 2025 patch day, this hits multiple SAP NetWeaver and ABAP stacks. RedRays’ analysis confirms exploitation via crafted print jobs, like GET /sap/bc/print?file=../../../../sapmnt/SYS/global/security/data/SSLClientSEPServer.pse. No AI hype here—this is classic web vuln amplified by enterprise trust in SAP services.

In practice, I’ve audited systems where Print Service ran on default ports (e.g., 8080), exposed via load balancers. Attackers probe, traverse to /usr/sap/<SID>/SYS/global/, and exfiltrate kernel configs or HANA credentials. Forward-thinking? Unpatched, this undermines Joule or AI Core trust boundaries.

What This Means for You

Basis admins: Your patching queue just got a red priority. Delay means exposure during peak ops, especially if Print Service feeds into document management tied to ML workflows.

Architects: Reassess microservices. If Print Service integrates with SAP Cloud Print or Fiori apps, traversal hits broader. In AI-heavy setups—say, HANA ML pipelines printing reports—this leaks training data paths or model artifacts.

Consultants: Clients often disable Print Service post-GoLive, but legacy S/4HANA ignores it. I’ve consulted Milan firms where “deactivated” services still listened on localhost proxies. Challenges? Patching might break custom print handlers; test in dev first. Skeptical note: SAP’s hotfixes work, but verify—no magic bullet if configs allow wildcard paths.

Real-world scenario: A manufacturing client exposed Print Service for label printing. Attacker traverses to /sapmnt/PER/global/abapdyndir/, grabs RFC destinations, pivots to HANA. Downtime? Weeks. Revenue? Millions.

Action Items

• Apply patches immediately: Use SUM or SPAM for October 2025 notes (e.g., 3610451 for NetWeaver). Verify via SOST transaction: post-patch, retry traversal payloads in a safe env.

  # Example SAT trace for verification (run in SE30)
  /sap/bc/print?file=../../../etc/passwd  # Should 403 now
  

• Harden configurations: Block unauth access. In profile params:

  icm/HTTP/mod_0 = PREFIX=/sap/bc/, PROT=PROTOCOL, AUTHORITY=*, TYPE=1
  # Add: login/accept_sso2_ticket=1  # But restrict Print Service URL
  

  Firewall port 81XX; use icm/server_port_X to disable if unused. Scan with RZ10 for open paths.
• Scan and audit: Run RSUSR003 or custom ABAP scan:

  REPORT z_dir_trav_scan.
  " Check S_PRINT* auth objects
  AUTHORITY-CHECK OBJECT 'S_PRINT' ID 'ACTVT' FIELD '03'.
  

  Tools like SAP Secure Login or external (Nessus) for full vuln scan. Prioritize prod if CVSS dictates.
• Monitor post-patch: Enable SEC logs via SM19; watch for 403s on print endpoints.

Community Perspective

RedRays’ blog highlights practitioner pain: many overlook Print Service in hybrid clouds, assuming it’s “internal.” Forums like SAP Community buzz with “patched, but print queues stalled”—test rigorously. Valuable insight: Pair with CIS benchmarks; one Basis lead shared a script automating ../ fuzzing via Python’s requests:

import requests
payloads = ['../../../etc/passwd', '../../../../sapmnt/SYS/global/secudir/']
for p in payloads:
    r = requests.get(f'http://<host>:8080/sap/bc/print?file={p}')
    if r.status_code == 200: print("VULN!")

Community consensus: Patch first, optimize later. European regs (DORA) amplify urgency for financials.

Bottom Line

CVSS 9.8 isn’t hype—it’s a neon sign screaming “exploit me.” In AI-driven enterprises, Print Service flaws erode trust in SAP’s innovation stack. Patch now; configs alone won’t cut it. From Milan, I’ve seen secure AI thrive on patched foundations. Hesitate, and you’re the case study. Get ahead.

Source: Original discussion/article

(748 words)

References

• SAP Security Notes & News
• SAP Community Hub

References

• SAP Community Hub
• SAP Security Patch Day October 2025 - Critical Updates
• SAP Security Notes & News