"Unauthenticated attackers can abuse built-in functionality to upload arbitrary files to an SAP NetWeaver instance, which means full Remote Code Execution and total system compromise," stated watchTowr CEO Benjamin Harris. The vulnerability, tracked under CVE-2025-31324 and rated critical (CVSS v3 score: 10.0), is an unauthenticated file upload vulnerability in SAP NetWeaver Visual Composer, specifically the Metadata Uploader component. Though the vendor's bulletin isn't public, ReliaQuest reported earlier this week about an actively exploited vulnerability on SAP NetWeaver Visual Composer, specifically the '/developmentserver/metadatauploader' endpoint, which aligns with CVE-2025-31324. It allows attackers to upload malicious executable files without needing to log in, potentially leading to remote code execution and full system compromise. SAP has released out-of-band emergency updates for NetWeaver to fix an actively exploited remote code execution (RCE) vulnerability used to hijack servers. These uploads enabled remote code execution via simple GET requests to the JSP files, allowing command execution from the browser, file management actions (upload/download), and more. ReliaQuest reported that multiple customers were compromised via unauthorized file uploads on SAP NetWeaver, with the attackers uploading JSP webshells to publicly accessible directories. In the post-exploitation phase, the attackers deployed the 'Brute Ratel' red team tool, the 'Heaven's Gate' security bypassing technique, and injected MSBuild-compiled code into dllhost.exe for stealth.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Fri, 25 Apr 2025 13:05:12 +0000