PT-2025-17845 · Sap · Sap Netweaver Visual Composer

Benjamin Harris · Published 2025-04-22 · Updated 2026-05-26 · CVE-2025-31324

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP NetWeaver versions prior to September 2025

Description A critical remote code execution issue exists in the SAP NetWeaver Development Server, specifically within the Visual Composer tool's Metadata Uploader function. The flaw is caused by inadequate authorization and insufficient validation of model files uploaded via the 'metadatauploader' endpoint, as well as deficiencies in the deserialization mechanism. This allows unauthenticated remote attackers to upload malicious executable binaries, often packaged as ZIP or JAR files with an application/octet-stream content type, which the server erroneously processes as safe. Once processed, this can lead to full system compromise, affecting confidentiality, integrity, and availability.

Real-world exploitation has been observed since March 2025, with increased activity following an exploit release in August 2025. Attackers, including China-nexus APTs and groups like Lapsus and Shinyhunters, have targeted government, retail, telco, and financial sectors, including a U.S.-based chemicals company. Exploitation chains have involved the deployment of web shells such as 'helper.jsp' and 'cache.jsp', and the installation of a Linux backdoor named Auto-Color to maintain persistence, execute reverse shells, and steal data.

Recommendations Apply SAP security updates released in September 2025. Deploy intrusion prevention and detection systems (IPS/IDS) to identify POST requests to the 'metadatauploader' endpoint containing application/octet-stream indications and binary payloads. Use endpoint detection and response (EDR) solutions to monitor for anomalous SAP process behaviors, such as unexpected command line executions. Restrict exposure of development servers to trusted networks.

Fix

RCE

Unrestricted File Upload

Deserialization of Untrusted Data

Weakness Enumeration

CWE-434

CWE-502

Related Identifiers

BDU:2025-04927

BDU:2025-05676

CVE-2025-31324

SAPNETWEAVERCVE2025_31324

Affected Products

Sap Netweaver Visual Composer

References · 714

• https://url.sap/sapsecuritypatchday · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-31324 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-04927 · Security Note
• https://me.sap.com/notes/3594142 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-31324 · Security Note
• https://bdu.fstec.ru/vul/2025-05676 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-31324 · Security Note
• https://github.com/ehang-io/nps · Note
• https://github.com/tdragon6/Supershell · Note
• https://github.com/vxCrypt0r/Voidmaw · Note
• https://github.com/ShadowMccc/MemoryEvasion · Note
• https://github.com/TophantTechnology/ARL-doc · Note
• https://twitter.com/TheHackersNews/status/1917145104931815445 · Twitter Post
• https://twitter.com/autumn_good_35/status/1916852628409163957 · Twitter Post
• https://twitter.com/WhichbufferArda/status/1917710109054230876 · Twitter Post