CVE-2005-3634 in Web Application Server
Summary
by MITRE
frameset.htm in the BSP runtime in SAP Web Application Server (WAS) 6.10 through 7.00 allows remote attackers to log users out and redirect them to arbitrary web sites via a close command in the sap-sessioncmd parameter and a URL in the sap-exiturl parameter.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/22/2025
The vulnerability described in CVE-2005-3634 represents a critical session management flaw within SAP Web Application Server BSP runtime components. This issue affects SAP WAS versions 6.10 through 7.00 and specifically targets the frameset.htm file which serves as a core component in the BSP (Business Server Pages) runtime environment. The vulnerability operates through a sophisticated manipulation of session commands and URL redirection parameters that can be exploited by remote attackers without requiring authentication or privileged access.
The technical exploitation mechanism relies on two specific parameters within the SAP BSP runtime interface: sap-sessioncmd and sap-exiturl. When an attacker crafts a malicious request containing a close command within the sap-sessioncmd parameter combined with a malicious URL in the sap-exiturl parameter, the system processes these commands in a manner that terminates user sessions and redirects them to arbitrary web destinations. This creates a dangerous scenario where authenticated users can be abruptly logged out and their browsers redirected to potentially malicious websites, effectively compromising user sessions and potentially enabling further attacks such as session hijacking or credential theft.
The operational impact of this vulnerability extends beyond simple session termination and redirection. From a cybersecurity perspective, this flaw aligns with CWE-613, which addresses insufficient session expiration, and can be categorized under ATT&CK technique T1566 for social engineering via malicious links. The vulnerability creates a pathway for attackers to perform session fixation attacks, where users are redirected to malicious sites that can capture session tokens or perform other malicious activities. Additionally, the flaw can be leveraged in conjunction with other attacks to create a more comprehensive compromise of the SAP environment.
Security professionals must understand that this vulnerability represents a fundamental flaw in SAP's session management architecture, where user sessions are not properly validated or secured against manipulation through crafted parameters. The impact is particularly severe in enterprise environments where SAP systems handle sensitive business data and user authentication. Organizations should consider implementing network-level controls such as web application firewalls to monitor and block suspicious parameter combinations, while also ensuring that SAP systems are properly patched and updated to address this vulnerability. The flaw demonstrates the importance of proper input validation and session handling in enterprise web applications, particularly those dealing with user authentication and authorization processes.