CVE-2025-31324

What it actually does

The flaw is an authorization bypass in the SAP NetWeaver Visual Composer Metadata Uploader. The upload function can be reached without proper authentication or authorization, allowing a remote unauthenticated attacker to upload executable binaries or server-side payloads to the SAP Java environment. If the uploaded content is placed in an executable web context, the attacker can achieve remote code execution in the security context of the SAP NetWeaver application server. This can lead to full compromise of the SAP host, unauthorized access to SAP application data and configuration, modification of business data or application logic, service disruption, credential theft, and pivoting to connected systems.

Why it matters to the business

This is a critical, internet-exploitable SAP NetWeaver flaw with confirmed active exploitation, inclusion in CISA KEV, a past KEV remediation deadline of 2025-05-20, EPSS of 0.99512, and reported ransomware use by Qilin, BianLian, RansomExx, DragonForce, and Play-linked campaigns. Successful compromise can give attackers control over a business-critical SAP application server, enabling data theft, manipulation of business processes, service disruption, lateral movement, and ransomware deployment. Because SAP NetWeaver commonly supports core ERP, finance, procurement, HR, manufacturing, and integration workflows, compromise can have direct operational and regulatory consequences.

How an attack unfolds

An attacker first identifies an exposed SAP NetWeaver Java system with Visual Composer components reachable over HTTP or HTTPS. The vulnerable Metadata Uploader endpoint lacks proper authorization, so the attacker does not need valid SAP credentials. The attacker sends a crafted upload request to the Visual Composer Metadata Uploader and places an executable server-side file, commonly a JSP web shell or similar payload, into a location where the SAP Java runtime can execute it. The attacker then browses to the uploaded payload and issues commands through the SAP application server process. From there, they typically enumerate the host, read SAP configuration and credentials, access connected databases or file shares, deploy persistence, move laterally, exfiltrate sensitive business data, or hand off access to ransomware operators. Public reporting and KEV status indicate this is not theoretical; it has been actively used in Q2 2025 exploitation and ransomware campaigns.

How to fix it

Apply the SAP security fix for CVE-2025-31324 immediately, including SAP Security Note 3594142 and any later superseding SAP Security Notes or support packages for SAP NetWeaver Visual Composer. If exact fixed package levels are not centrally tracked, use SAP’s official maintenance planner and note assistant to identify the required patch level for each installed SAP NetWeaver release. Treat patching as emergency work because the vulnerability is in CISA KEV, the due date has passed, EPSS is extremely high, and ransomware exploitation has been reported. If immediate patching is not possible, disable or remove Visual Composer if not required, block external access to /developmentserver/metadatauploader at WAF, reverse proxy, Web Dispatcher, and network layers, require strict authentication and allowlisting for administrative SAP Java endpoints, and restrict SAP NetWeaver management interfaces to trusted administration networks only. After patching, remove unauthorized uploaded files, rotate credentials and secrets accessible from the SAP host, and rebuild from trusted media if web shell execution or ransomware staging is confirmed.

How to confirm the fix worked

Confirm remediation by verifying the relevant SAP Security Note is implemented through SAP Note Assistant, system component patch levels, and maintenance planner output. Test that unauthenticated requests to /developmentserver/metadatauploader are denied, blocked, or no longer handled by the vulnerable component. From an unauthenticated network vantage point, the endpoint should not allow file upload and should return an access denied, authentication required, not found, or blocked response depending on the chosen remediation. Validate WAF, Web Dispatcher, and reverse proxy rules by attempting a benign request to the endpoint and confirming it is logged and blocked. On the host, verify no unauthorized executable files remain in SAP Java web application directories and that SAP Java processes are not spawning command interpreters. Run an authenticated vulnerability scan or SAP-specific security assessment after patching to confirm the vulnerable component and support package level are no longer exposed.

Typical attack path

1. Scan for SAP NetWeaver Java systems exposed to the internet or reachable from a compromised network segment.
2. Probe for the Visual Composer Metadata Uploader endpoint, commonly under /developmentserver/metadatauploader.
3. Send an unauthenticated crafted upload request containing a malicious executable payload such as a JSP web shell.
4. Access the uploaded payload through the SAP web application path to execute commands on the server.
5. Enumerate the SAP host, environment variables, filesystem, users, network routes, and connected services.
6. Harvest SAP, database, operating-system, and service credentials from configuration files, memory, logs, or local stores.
7. Establish persistence through additional web shells, scheduled tasks, services, startup scripts, or attacker-controlled accounts.
8. Move laterally to database servers, file shares, identity infrastructure, or other business-critical systems.
9. Exfiltrate sensitive SAP and business data or stage ransomware tooling.
10. Disrupt operations through encryption, deletion, business data manipulation, or SAP service shutdown.

How to detect it

Investigate whether the Visual Composer Metadata Uploader endpoint was accessed, especially from untrusted IP addresses, before patching. Review SAP Web Dispatcher, reverse proxy, WAF, load balancer, and SAP NetWeaver HTTP access logs for requests to /developmentserver/metadatauploader, particularly POST requests, multipart uploads, unusual user agents, missing authentication context, HTTP 200/201/500 responses, or immediate follow-on requests to newly created JSP files. On SAP application servers, search for recently created or modified executable web content, especially JSP files under SAP Java application, portal, irj, servlet_jsp, temp, and work directories. Review SAP Java defaultTrace, security, audit, and application logs for upload activity, class loading errors, command execution, or unexpected servlet/JSP compilation. Examine OS telemetry for SAP Java processes spawning shell interpreters, scripting engines, archive utilities, download tools, credential dumping tools, or ransomware tooling. Because ransomware campaigns have exploited this issue, also hunt for credential access, remote service creation, new administrative accounts, unusual outbound connections, mass file encryption behavior, and lateral movement from SAP servers.

• /developmentserver/metadatauploader
• POST /developmentserver/metadatauploader
• GET /developmentserver/metadatauploader
• multipart/form-data
• Content-Disposition: form-data
• j2ee/cluster/apps/sap.com/irj/servlet_jsp/irj/root/
• /irj/
• /irj/*.jsp
• /bin/sh -c
• /bin/bash -c
• cmd.exe /c
• powershell.exe
• certutil.exe
• curl
• wget
• whoami
• id;
• uname -a
• net user
• sapstartsrv
• jlaunch
• server0
• defaultTrace.trc

What your security team should do

• Patch all affected SAP NetWeaver Visual Composer systems immediately and verify SAP Note 3594142 or superseding fixes are applied.
• Assume internet-exposed unpatched systems may already be compromised; perform incident response and forensic review, not just vulnerability remediation.
• Block and monitor access to /developmentserver/metadatauploader from untrusted networks at WAF, reverse proxy, Web Dispatcher, and perimeter controls.
• Search for unauthorized JSPs, web shells, recently modified SAP Java application files, and SAP Java processes spawning operating-system commands.
• Prioritize ransomware readiness: isolate suspicious SAP hosts, validate backups, review privileged account use, and hunt for lateral movement and data staging.
• Rotate SAP, database, service, and operating-system credentials if compromise is suspected or confirmed.
• Add SIEM detections for POST requests to the vulnerable endpoint, creation of executable files under SAP Java web paths, and command shells spawned by SAP Java processes.
• Review whether Visual Composer is required; disable or remove it where there is no business need.
• Because the KEV deadline has passed, track remediation through executive risk governance until all exposed instances are patched or otherwise removed from risk.