CVE-2021-38163

What it actually does

SAP NetWeaver Visual Composer 7.0 RT in affected 7.30, 7.31, 7.40, and 7.50 releases allows an authenticated non-administrative user to upload a malicious file over the network and trigger server-side processing of that file. Because the upload and processing path is insufficiently restricted, attacker-controlled content can cause operating system command execution with the privileges of the SAP Java Server process. Successful exploitation can result in full compromise of confidentiality, integrity, and availability for data and applications accessible to that Java process, including file read/write, application modification, service disruption, and potential lateral movement from the SAP host.

Why it matters to the business

This is a critical SAP application-server compromise risk affecting business-critical NetWeaver deployments. An attacker with any valid low-privilege SAP account may be able to take control of the server process, access or alter sensitive business data, disrupt SAP services, or use the host as a foothold into the wider enterprise. The vulnerability is listed in CISA KEV, has been observed exploited in the wild, and its federal remediation due date was 2022-06-30, so unremediated internet- or partner-accessible systems should be treated as high-priority exposure requiring immediate action.

How an attack unfolds

An attacker first obtains or abuses a valid non-administrative SAP NetWeaver account. They then access Visual Composer functionality exposed over the network and upload a crafted file that bypasses expected content or path restrictions. The attacker triggers Visual Composer processing of the uploaded content, causing the Java application server to interpret attacker-controlled input in a way that executes operating system commands. Those commands run as the SAP Java Server process account, allowing the attacker to read application files, modify deployed content, create additional web-accessible artifacts, run reconnaissance commands, disable services, or shut down the server. In real intrusions, exploitation should be expected to be followed by credential theft, persistence attempts, log tampering, and movement to adjacent SAP or infrastructure systems.

How to fix it

Apply the relevant SAP Security Notes and support package updates for CVE-2021-38163/SAP NetWeaver Visual Composer 7.0 RT across all affected 7.30, 7.31, 7.40, and 7.50 systems. No fixed package versions were provided in the input, so administrators should confirm remediation through SAP Maintenance Planner, SAP Notes, and system component patch levels. If Visual Composer is not required, disable or remove it. Restrict Visual Composer and SAP NetWeaver Java administrative/runtime endpoints to trusted management networks only, and avoid exposing them directly to the internet. Enforce least-privilege SAP roles so ordinary users cannot access upload or design-time functionality unless business-required. Add compensating controls such as reverse proxy/WAF restrictions for suspicious upload extensions and paths, file integrity monitoring for SAP Java directories, and outbound egress controls from SAP application servers. If exploitation is suspected, preserve evidence, isolate the host, rotate SAP and operating-system credentials that may have been accessible, and rebuild from trusted media if server-level compromise cannot be ruled out.

How to confirm the fix worked

Confirm that every SAP NetWeaver Java system running Visual Composer 7.0 RT has the applicable SAP Security Note or support package implemented. Review installed software component and support package levels in SAP administration tooling and compare them with SAP’s official fixed guidance. Verify that Visual Composer is disabled if not required. From a controlled test account with non-administrative privileges, confirm that upload features reject dangerous file types and path manipulation attempts and that uploaded content cannot be processed into command execution. Validate that Visual Composer endpoints are not reachable from untrusted networks. Inspect application directories for unexpected recently created executable content, web components, scripts, or modified archives. Review logs after patching to ensure blocked upload attempts are recorded and that normal Visual Composer functionality still works where required.

Typical attack path

1. Identify an exposed SAP NetWeaver Java system with Visual Composer 7.0 RT enabled.
2. Authenticate with a valid low-privilege user account.
3. Reach Visual Composer upload or runtime functionality over HTTP/S.
4. Upload a malicious file designed to be processed by the server.
5. Trigger processing of the uploaded file through Visual Composer.
6. Execute operating system commands as the SAP Java Server process user.
7. Read or modify SAP application files, configuration, credentials, or business data accessible to that process.
8. Establish persistence, clean up traces, disrupt service, or pivot to other systems.

How to detect it

Hunt for evidence of prior exploitation in SAP NetWeaver Java HTTP access logs, default trace logs, application logs, security audit logs, reverse proxy/WAF logs, operating-system process telemetry, and file integrity monitoring. Focus on authenticated users accessing Visual Composer paths followed by unusual uploads, server errors, new or modified executable files, and child processes spawned by the SAP Java runtime. Review filesystem activity in SAP Java application, temporary, work, deployment, and upload directories for recently created JSP/JSPX, WAR, EAR, ZIP, shell script, batch, or binary files. Correlate upload events with process execution such as shells, PowerShell, curl/wget, chmod, whoami, id, net, ipconfig, or service-control commands executed under the SAP Java service account. Look for service shutdowns or restarts shortly after Visual Composer requests. Because exploitation requires authentication, investigate low-privilege accounts that performed upload or Visual Composer actions inconsistent with their normal role. If threat actor reporting or alerts reference SAP NetWeaver unrestricted file upload activity, prioritize those events and preserve raw logs before rotation.

• /VC/
• Visual Composer
• com.sap.visualcomposer
• .jsp upload
• .jspx upload
• .war upload
• .ear upload
• jstart spawning /bin/sh
• jstart spawning /bin/bash
• jstart spawning cmd.exe
• jstart spawning powershell.exe
• jstart spawning wget
• jstart spawning curl
• /usr/sap/
• /j2ee/cluster/server
• /j2ee/cluster/apps/
• /j2ee/cluster/server0/temp/
• /j2ee/cluster/server0/work/
• /j2ee/cluster/server1/temp/
• /j2ee/cluster/server1/work/
• dev_server0
• dev_server1
• defaultTrace.trc
• security_audit.log

What your security team should do

• Immediately identify all SAP NetWeaver Java systems with Visual Composer 7.0 RT, especially versions 7.30, 7.31, 7.40, and 7.50.
• Prioritize remediation ahead of routine patch cycles because the vulnerability is in CISA KEV and has active in-the-wild exploitation history.
• Apply the applicable SAP Security Notes/support packages or disable Visual Composer where it is not business-critical.
• Restrict Visual Composer and SAP NetWeaver Java endpoints to trusted networks and require strong authentication controls.
• Audit SAP user roles for unnecessary access to upload, design-time, or Visual Composer functions.
• Run threat hunting across SAP Java logs, HTTP access logs, filesystem changes, and process execution telemetry for signs of malicious uploads and command execution.
• If suspicious activity is found, treat the SAP Java server as potentially compromised, preserve forensic evidence, rotate credentials, and assess downstream SAP systems for lateral movement.
• Add monitoring for SAP Java processes spawning operating-system shells, scripting engines, or administrative utilities.