CVE-2025-31324: SAP NetWeaver Auth Bypass Vulnerability

CVE-2025-31324 Overview

CVE-2025-31324 is a missing authorization vulnerability in the SAP NetWeaver Visual Composer Metadata Uploader. The /developmentserver/metadatauploader endpoint accepts file uploads without requiring authentication. Unauthenticated remote attackers can upload arbitrary executable binaries to the host system. Successful exploitation leads to full compromise of the SAP NetWeaver application server.

CISA added CVE-2025-31324 to the Known Exploited Vulnerabilities catalog. The flaw is classified as an Unrestricted Upload of File with Dangerous Type [CWE-434]. Attackers have used it to deploy webshells and gain remote code execution on internet-exposed SAP systems.

Critical Impact
Unauthenticated attackers can upload malicious executables to SAP NetWeaver, achieving remote code execution with full impact on confidentiality, integrity, and availability.

Affected Products

SAP NetWeaver 7.50
SAP NetWeaver Application Server Java with Visual Composer enabled
Systems exposing the /developmentserver/metadatauploader endpoint

Discovery Timeline

2025-04-24 - CVE-2025-31324 published to NVD
2025-10-31 - Last updated in NVD database

Technical Details for CVE-2025-31324

Vulnerability Analysis

The vulnerability resides in the Visual Composer Metadata Uploader component of SAP NetWeaver. The /developmentserver/metadatauploader servlet handles file upload requests but does not enforce authentication or authorization checks. Any network-reachable client can send a crafted HTTP POST request to upload arbitrary files.

Attackers abuse this behavior to drop JSP webshells into directories served by the SAP Java application server. Once written to disk, the webshell can be invoked via a follow-up HTTP request to execute operating system commands. Observed post-exploitation activity includes deployment of webshells such as helper.jsp and cache.jsp, reconnaissance commands, and lateral movement attempts.

The vulnerability falls into the Unrestricted File Upload class [CWE-434]. The component fails to validate both the requester's identity and the type of file being uploaded. The Visual Composer is an optional component but is enabled in many production deployments.

Root Cause

The Metadata Uploader endpoint was deployed without authorization filters protecting its servlet path. SAP did not enforce role checks or session validation before accepting multipart upload requests. The component also failed to restrict file extensions or content types, allowing executable JSP files to be written into web-accessible directories.

Attack Vector

Exploitation requires only network access to the SAP NetWeaver HTTP listener, typically TCP 443 or 50000-series ports. The attacker sends a multipart POST request to /developmentserver/metadatauploader containing a malicious JSP payload. The server stores the file in a directory reachable via HTTP. The attacker then requests the uploaded file URL, triggering server-side execution under the SAP service account.

No credentials, user interaction, or prior foothold are required. Internet-exposed NetWeaver instances have been targeted in active campaigns documented by Onapsis and reported by BleepingComputer and The Register.

Detection Methods for CVE-2025-31324

Indicators of Compromise

HTTP requests to /developmentserver/metadatauploader from external IP addresses, particularly POST methods with multipart bodies
Unexpected JSP files in NetWeaver web directories such as irj/root/ including names like helper.jsp, cache.jsp, or randomly named JSPs
Child processes spawned by the SAP Java server executing cmd.exe, sh, powershell.exe, or reconnaissance utilities
Outbound connections from SAP hosts to unrecognized command-and-control infrastructure

Detection Strategies

Inspect web server access logs for POST requests to the metadatauploader path and correlate with subsequent GET requests to newly created .jsp files
Monitor file system changes in SAP NetWeaver deployment directories for new or modified JSP, JAR, or WAR files
Hunt for anomalous process lineage where the SAP Java process spawns shell interpreters or system enumeration commands

Monitoring Recommendations

Enable centralized logging from SAP NetWeaver HTTP services and forward to a SIEM for retention and correlation
Baseline normal Visual Composer usage and alert on any access to the metadata uploader endpoint from outside trusted management networks
Track CISA KEV catalog updates and threat intelligence feeds covering SAP exploitation campaigns

How to Mitigate CVE-2025-31324

Immediate Actions Required

Apply SAP Note 3594142 to all affected NetWeaver Application Server Java instances without delay
Restrict network access to the /developmentserver/metadatauploader endpoint using a reverse proxy or web application firewall rule
Audit SAP web directories for unauthorized JSP files and remove any artifacts of compromise
Rotate credentials and service account secrets on hosts suspected of exposure

Patch Information

SAP released a fix as part of the April 2025 Security Patch Day. Administrators must apply SAP Note #3594142 to remediate the missing authorization check. Refer to the SAP Security Patch Day portal for additional guidance and to the Onapsis Blog: CVE-2025-31324 Exploitation for technical analysis of in-the-wild attacks.

Workarounds

Disable the Visual Composer development server component if it is not required in production deployments
Block external access to the metadatauploader URL path at the load balancer, reverse proxy, or WAF layer
Place SAP NetWeaver behind authenticated VPN access until the patch can be applied

bash

# Example WAF rule to block unauthenticated access to the vulnerable endpoint
# Apache mod_rewrite example
RewriteEngine On
RewriteRule ^/developmentserver/metadatauploader - [F,L]