Sap-Netweaver - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/sap-netweaver/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 03 Jan 2024 12:00:00 +0000SAP NetWeaver Visual Composer CVE-2025-31324 Exploitation Attempthttps://feed.craftedsignal.io/briefs/2024-01-sap-netweaver-visual-composer-exploitation/Wed, 03 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-sap-netweaver-visual-composer-exploitation/Exploitation attempts targeting CVE-2025-31324, a critical unauthenticated file upload vulnerability in SAP NetWeaver Visual Composer, have been detected using HTTP HEAD and POST requests to sensitive endpoints.Active exploitation of CVE-2025-31324, a critical unauthenticated file upload vulnerability in SAP NetWeaver Visual Composer, has been observed. This flaw allows remote attackers to send specially crafted POST requests to the /developmentserver/metadatauploader endpoint, enabling arbitrary file uploads, often leading to webshell deployment and subsequent system compromise. The attacks leverage HTTP HEAD and POST requests, targeting specific Visual Composer endpoints. Successful exploitation grants attackers privileged access, enabling malware deployment and impacting business-critical SAP resources. Public reports indicate that this vulnerability is being actively exploited in the wild, necessitating immediate patching and investigation of suspicious activity. This activity has been observed since early 2025.

Attack Chain

  1. Attacker identifies a vulnerable SAP NetWeaver instance running Visual Composer.
  2. The attacker sends a reconnaissance HTTP HEAD request to /ctc/CTCWebService/CTCWebServiceBean, /CTCWebService/CTCWebServiceBean, or /VisualComposer/services/DesignTimeService to confirm the presence of the vulnerable component.
  3. Upon successful reconnaissance (HTTP 200 OK), the attacker crafts a malicious HTTP POST request to the /developmentserver/metadatauploader endpoint.
  4. The POST request contains a specially crafted payload designed to upload an arbitrary file, typically a webshell (e.g., a JSP or ASPX file).
  5. The SAP NetWeaver server processes the malicious POST request without proper authentication or input validation.
  6. The webshell is successfully uploaded to the server's file system, often in a publicly accessible directory.
  7. The attacker accesses the uploaded webshell via a web browser, gaining remote code execution capabilities on the SAP NetWeaver server.
  8. The attacker leverages the compromised server to escalate privileges, move laterally within the network, and potentially exfiltrate sensitive data or deploy ransomware.

Impact

Successful exploitation of CVE-2025-31324 allows attackers to gain complete control over vulnerable SAP NetWeaver systems. This can lead to the compromise of sensitive business data, disruption of critical business processes, and significant financial losses. Public reports indicate active exploitation across various sectors, potentially impacting hundreds of organizations running vulnerable SAP NetWeaver instances. Exploitation enables attackers to deploy malware, exfiltrate data, and disrupt operations.

Recommendation

  • Deploy the Sigma rule SAP NetWeaver Visual Composer Exploitation Attempt to your SIEM to detect malicious HTTP requests to vulnerable endpoints.
  • Apply the latest SAP security patches to remediate CVE-2025-31324 on all affected SAP NetWeaver systems.
  • Investigate any HTTP HEAD or POST requests with a 200 OK status to the Visual Composer endpoints listed in the Sigma rule to identify potential exploitation attempts.
  • Monitor web server logs and network traffic for suspicious file uploads and webshell activity following successful endpoint access.
  • Review access controls and network segmentation to limit the potential impact of a successful compromise.
]]>criticalthreatsap-netweaverfile-uploadwebshellcve-2025-31324