CVE-2021-38163: SAP NetWeaver Visual Composer RCE Flaw

CVE-2021-38163 Overview

CVE-2021-38163 is a critical path traversal vulnerability affecting SAP NetWeaver Visual Composer 7.0 RT. This vulnerability allows an authenticated non-administrative user to upload malicious files over the network without restriction. Once uploaded, these files can be processed in a way that executes arbitrary operating system commands with the privileges of the Java Server process, potentially leading to complete system compromise.

Critical Impact

Attackers can achieve remote code execution, read or modify sensitive information on the server, and cause denial of service by shutting down the server. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild.

Affected Products

• SAP NetWeaver 7.30
• SAP NetWeaver 7.31
• SAP NetWeaver 7.40
• SAP NetWeaver 7.50

Discovery Timeline

• September 14, 2021 - CVE-2021-38163 published to NVD
• February 25, 2026 - Last updated in NVD database

Technical Details for CVE-2021-38163

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Path Traversal), allowing attackers to bypass intended file upload restrictions and write files to arbitrary locations on the server filesystem. The Visual Composer component in SAP NetWeaver fails to properly sanitize file paths during the upload process, enabling authenticated users to traverse directory structures using special character sequences.

The impact of successful exploitation is severe: attackers can execute operating system commands with the same privileges as the Java Server process running SAP NetWeaver. This typically provides extensive access to the underlying system, including the ability to read sensitive configuration files, modify application data, exfiltrate business-critical information, or completely disable the server.

Root Cause

The root cause lies in insufficient input validation and path sanitization within the Visual Composer file upload functionality. The component fails to properly neutralize path traversal sequences (such as ../) in user-supplied filenames or paths, allowing attackers to specify locations outside the intended upload directory. Combined with the ability to trigger processing of uploaded files, this creates a complete attack chain from file upload to code execution.

Attack Vector

The attack is network-based and requires low-privilege authentication to the SAP NetWeaver system. An attacker with valid credentials, even as a non-administrative user, can craft a malicious file upload request that:

1. Utilizes path traversal sequences to place the file in a location where it will be automatically processed or executed
2. Contains payload designed to execute operating system commands
3. Triggers the Java Server to process the malicious file

The exploitation does not require user interaction beyond the attacker's own actions. Once the malicious file is processed, commands execute with the privileges of the SAP NetWeaver Java Server process.

The attack leverages the file upload functionality in the Visual Composer component to place a malicious file in a location where it can be processed by the server. By manipulating the file path parameter with directory traversal sequences, an attacker can write files outside the intended upload directory. When these files are subsequently processed by the Java Server, any embedded commands are executed with server-level privileges. This exploitation method is well-documented and has been observed in active attacks, as evidenced by its inclusion in the CISA Known Exploited Vulnerabilities Catalog.

Detection Methods for CVE-2021-38163

Indicators of Compromise

• Unusual file upload requests to Visual Composer endpoints containing path traversal sequences such as ../ or encoded variants like %2e%2e%2f
• Unexpected files appearing in directories outside the standard upload locations on SAP NetWeaver servers
• Evidence of command execution originating from the Java Server process (e.g., spawning shells or executing system utilities)
• Anomalous network activity from SAP NetWeaver servers to external destinations following file upload events

Detection Strategies

• Monitor web application logs for HTTP requests to Visual Composer upload endpoints containing path manipulation patterns
• Implement file integrity monitoring on SAP NetWeaver server directories to detect unauthorized file creations
• Deploy endpoint detection rules to identify process chains where the Java Server process spawns unexpected child processes
• Configure SIEM alerts for authentication events followed by suspicious file operations on NetWeaver systems

Monitoring Recommendations

• Enable verbose logging on SAP NetWeaver Visual Composer components and centralize logs for analysis
• Implement network traffic analysis to detect large or unusual file uploads to SAP systems
• Monitor for privilege escalation attempts or lateral movement following any detected exploitation attempts
• Review SAP Security Audit Logs regularly for anomalous user activity patterns

How to Mitigate CVE-2021-38163

Immediate Actions Required

• Apply the security patch referenced in SAP Note #3084487 immediately
• Review Visual Composer deployment necessity and consider disabling the component if not required for business operations
• Audit user accounts with access to Visual Composer and remove unnecessary permissions
• Implement network segmentation to limit access to SAP NetWeaver servers from untrusted networks

Patch Information

SAP has released a security patch addressing this vulnerability. Organizations should obtain and apply the patch following the instructions in SAP Note #3084487. Additional security guidance is available on the SAP Wiki Security Page. Given the active exploitation status confirmed by CISA, patching should be treated as an urgent priority.

Workarounds

• If patching cannot be performed immediately, consider disabling the Visual Composer component entirely if it is not business-critical
• Implement web application firewall (WAF) rules to block requests containing path traversal patterns targeting Visual Composer endpoints
• Restrict network access to SAP NetWeaver systems using firewall rules to allow only trusted IP addresses
• Implement additional authentication controls or access restrictions for Visual Composer functionality until the patch can be applied

# Example: Restrict access to Visual Composer at the network level
# Add firewall rules to limit access to SAP NetWeaver ports
# iptables example - restrict port 50000 to specific trusted networks
iptables -A INPUT -p tcp --dport 50000 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 50000 -j DROP