Skip to main content
SAP Pentest Playbook
Toggle Dark/Light/Auto mode Toggle Dark/Light/Auto mode Toggle Dark/Light/Auto mode Back to homepage
  2. /
  3. SAP NetWeaver JAVA
  4. /
  5. Known Attack Vectors
  6. /
  7. P4/RMI Insecure Deserialization (CVE-2025-42944)
Edit page

P4/RMI Insecure Deserialization (CVE-2025-42944)

Description

P4 is SAP AS Java’s proprietary RMI-based remote-object protocol, exposed by default on port 5NN04 (50004 on instance 00; TLS variant 5NN06) - see Technology Overview. It is the transport for the legacy Visual Administrator and JMX-style remote management, and it deserializes Java objects sent by remote clients.

CVE-2025-42944 is an unauthenticated insecure-deserialization flaw in the RMI-P4 module: an attacker who can reach the open P4 port submits a malicious serialized Java object, and the engine’s deserialization of that untrusted object leads to arbitrary OS command execution on the AS Java host - no credentials required. Because the only precondition is network reachability to 5NN04, a P4 port reachable from an untrusted network is a critical finding on its own, independent of any further exploitation.

Deserialization RCE of this class typically executes as the AS Java OS user (<sid>adm), which is a direct route from an unauthenticated network position to an OS foothold and from there to the AS Java Secure Store and every backend the Java stack trusts.

Risk

  • CVE-2025-42944 - Insecure Deserialization in SAP NetWeaver AS Java (RMI-P4) (CWE-502). CVSS 3.0 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), HotNews. Confirmed via SAP Note 3634501: “an unauthenticated attacker could exploit the system through the RMI-P4 module by submitting malicious payload to an open port. The deserialization of such untrusted Java objects could lead to arbitrary OS command execution.” Component BC-JAS-COR-RMT (RMI, P4, CORBA, IIOP); affects SERVERCORE 7.50. Released 08.09.2025 (re-released through Oct 2025).

Related AS Java RMI/P4 and unauthenticated-RCE findings worth checking on the same target during the same pass:

  • CVE-2025-42925 - Predictable Object Identifier in the AS Java IIOP service (same BC-JAS-COR-RMT module family), SAP Note 3640477. Lower severity but same protocol surface.
  • CVE-2025-31324 - Missing authorization in the NetWeaver Visual Composer Metadata Uploader (/developmentserver/metadatauploader), CVSS 3.0 10.0, SAP Note 3594142 (+ follow-up 3604119). A separate, HTTP-based unauthenticated file-upload -> RCE on VCFRAMEWORK 7.50 - mass-exploited in 2025; check it alongside P4 when profiling a 7.50 AS Java.

Options

  • Fingerprint - confirm P4 reachability (5NN04/5NN06) per Network Service Discovery. P4 is a binary RMI protocol, not a text-banner service, so positively identify it by correlating the open port against an AS Java HTTP fingerprint on the same host/instance-number pair. Reachability from an untrusted network is itself reportable.
  • Version-gate before exploitation - the flaw is fixed by an updated P4-Lib in SERVERCORE 7.50; establish the target’s SPS/patch level (NWA version tile, GET /nwa, or sap/monitoring/SystemInfo) before investing effort.
  • Exploit (unauthenticated RCE) - deliver a Java deserialization gadget-chain payload to the P4 port; successful deserialization yields OS command execution in the AS Java process context (<sid>adm).
  • Post-exploitation - from OS execution as <sid>adm, harvest the AS Java Secure Store (SecStore.properties/SecStore.key) for the master password and DB/RFC/LDAP connection secrets, then pivot into the trusted backends.

Mitigation

  • Patch to the fixed P4-Lib build per SAP Note 3634501. Note the SAP-stated prerequisite: a JVM newer than Java 8 u121 must be in place for the fix to apply (update the JVM per SAP Note 2695197 if needed), and check SAP Note 1974464 for SCA dependency compatibility before deploying.
  • Workaround (when patching is not immediately possible) - apply P4 port filtering at the ICM level (the HOST subparameter of the P4 port configuration): allow-list the hosts that legitimately need P4 and exclude all others, so untrusted hosts cannot reach the port. This is the SAP-documented temporary mitigation and can be rolled back after patching.
  • Network-restrict P4 regardless of patch state - 5NN04/5NN06 should never be reachable from user or untrusted networks; confine it to the administrative/deployment segment.

Detection and Monitoring

  • Network exposure - flag any 5NN04/5NN06 reachable outside the management segment as a standalone finding, independent of patch level.
  • P4 connection anomalies - connections to the P4 port from hosts outside the allow-list of legitimate P4/deployment clients; the ICM-level HOST filter (above) turns “who may connect at all” into an enforceable, loggable control.
  • OS-level RCE artifacts - since successful exploitation runs as <sid>adm, monitor for unexpected child processes, shell spawns, or file writes under the AS Java runtime user, and for subsequent reads of the sec directory (SecStore.*) - the natural next step after an OS foothold.
  • Correlate P4 exploitation attempts with the related HTTP vector CVE-2025-31324 (/developmentserver/metadatauploader) when triaging a 7.50 AS Java under active attack.

References