Threat Brief: CVE-2025-31324 (Updated June 25)
Summary: SAP disclosed CVE-2025-31324 on April 24, 2025, a CVSS 10.0 missing authorization check in the NetWeaver Visual Composer Framework version 7.50 that lets unauthenticated users upload arbitrary files through the /developmentserver/metadatauploader endpoint, leading to potential remote code execution. Unit 42 observed suspicious requests to that endpoint in late January 2025, exploitation to deploy JSP web shells such as cache.jsp and helper.jsp starting in mid-March 2025, and later post-compromise activity including GOREVERSE reverse shells and a Cobalt Strike beacon, before ending monitoring on June 25, 2025.
Bottom line: A CVSS 10.0 flaw requiring no authentication let attackers write web shells to SAP servers and run commands as the sidadm system account, and Unit 42 saw probing of the endpoint roughly three months before SAP disclosed the vulnerability.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Detection & Response
- Mentions
- CVE-2025-31324
- Related
- Understanding the challenges of securing an NGO Cyber Risks ·CVE-2025-31324: SAP Net Weaver Unrestricted File Upload Vulnerability Known Exploited Vulnerabilities · Apr 29, 2025