PT-2025-17845 · Sap · Sap Netweaver Visual Composer

Benjamin Harris

·

Published

2025-04-22

·

Updated

2025-11-26

·

CVE-2025-31324

CVSS v3.1
10
VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions SAP NetWeaver (affected versions not specified)
Description SAP NetWeaver is affected by a critical vulnerability (CVE-2025-31324) allowing unauthenticated attackers to upload malicious files, potentially leading to remote code execution and full system compromise. This flaw resides in the Visual Composer Metadata Uploader, lacking proper authorization checks. Numerous threat actors, including China-linked APT groups and ransomware operations (Qilin, Scattered Lapsus$ Hunters), are actively exploiting this vulnerability. Exploitation has been observed globally, impacting critical infrastructure sectors like energy, government, and healthcare. Attackers are deploying webshells, malware (Auto-Color), and utilizing techniques like the deployment of Golang-based backdoors. The vulnerability has a CVSS score of 10.0, indicating its critical severity. Over 1,200 systems are reported to be vulnerable.
Recommendations Apply the latest SAP security patch (Security Note 3594142) immediately. If patching is not immediately possible, restrict access to the /developmentserver/metadatauploader endpoint and disable Visual Composer if it is not in use. Implement robust monitoring and logging to detect suspicious activity. Utilize intrusion detection and prevention systems (IDS/IPS) to identify and block exploitation attempts. Regularly scan systems for vulnerabilities and ensure timely patching.

Exploit

Fix

RCE

Unrestricted File Upload

Deserialization of Untrusted Data

Weakness Enumeration

CWE-434CWE-502

Related Identifiers

BDU:2025-04927
BDU:2025-05676
CVE-2025-31324

Affected Products

Sap Netweaver Visual Composer