{"id":"CVE-2025-31324","published":"2025-04-24T17:15:35Z","modified":"2026-08-04T05:16:34Z","title":"SAP NetWeaver Unrestricted File Upload Vulnerability","vendor":"SAP","product":"NetWeaver","tier":"core","eol":null,"description":{"text":"SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw lies in the Visual Composer Metadata Uploader component of SAP NetWeaver, which is not protected by proper authorization checks. An unauthenticated attacker over the network can exploit it, with no user interaction required, to upload potentially malicious executable files to the host system, which could compromise its confidentiality, integrity, and availability.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T06:58:06Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99486,"percentile":0.99944,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2025-04-29","dueDate":"2025-05-20","ransomware":true,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://me.sap.com/notes/3594142 ; https://nvd.nist.gov/vuln/detail/CVE-2025-31324","provenance":"source"},"vulncheckKev":{"dateAdded":"2025-04-22","exploitedFirstSeen":"2025-04-22","ransomware":true,"evidence":[{"url":"https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/","date":"2025-04-22"},{"url":"https://arcticwolf.com/resources/blog-uk/cve-2025-31324-maximum-severity-file-upload-vulnerability-in-sap-netweaver-exploited-in-the-wild/","date":"2025-04-25"},{"url":"https://x.com/gothburz/status/1915755189019017411","date":"2025-04-25"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-04-27&host_type=src&vulnerability=cve-2025-31324","date":"2025-04-27"},{"url":"https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/","date":"2025-04-27"},{"url":"https://digital.nhs.uk/cyber-alerts/2025/cc-4649","date":"2025-04-28"},{"url":"https://research.splunk.com/stories/sap_netweaver_exploitation/","date":"2025-04-28"},{"url":"https://www.rapid7.com/blog/post/2025/04/28/etr-active-exploitation-of-sap-netweaver-visual-composer-cve-2025-31324/","date":"2025-04-28"},{"url":"https://x.com/nextronresearch/status/1916860589978120572","date":"2025-04-28"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-04-29&host_type=src&vulnerability=cve-2025-31324","date":"2025-04-29"}],"evidenceTotal":391,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"skynox7: Proxyjacking Edge Devices Into Residential Proxies","url":"https://otx.alienvault.com/pulse/6ad9e65d5b3dc4f0fcdc04c3","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"}],"provenance":"machine"},"cwes":[{"id":"CWE-434","name":"Unrestricted Upload of File with Dangerous Type"}],"references":[{"url":"https://me.sap.com/notes/3594142","tags":["Permissions Required"]},{"url":"https://url.sap/sapsecuritypatchday","tags":["Vendor Advisory"]},{"url":"https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/","tags":["Third Party Advisory"]},{"url":"https://www.bleepingcomputer.com/news/security/sap-fixes-suspected-netweaver-zero-day-exploited-in-attacks/","tags":["Press/Media Coverage"]},{"url":"https://www.theregister.com/2025/04/25/sap_netweaver_patch/","tags":["Press/Media Coverage"]},{"url":"https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31324","tags":["US Government Resource"]}],"techniques":[{"id":"T1055","name":"Process Injection","tactics":["privilege-escalation","stealth"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Unrestricted File Upload","mappingType":"exploitation_technique","evidence":[],"comment":"Attackers have exploited this SAP vulnerability to achieve remote code execution on the target system by sending malicious ZIP files to specific server endpoints. This can be done either through use of a single command or by uploading a web shell.","confidence":"high"},{"id":"T1505.003","name":"Web Shell","tactics":["persistence"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Unrestricted File Upload","mappingType":"exploitation_technique","evidence":[],"comment":"Attackers have exploited this SAP vulnerability to achieve remote code execution on the target system by sending malicious ZIP files to specific server endpoints. This can be done either through use of a single command or by uploading a web shell.","confidence":"high"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Unrestricted File Upload","mappingType":"primary_impact","evidence":[],"comment":"Attackers have exploited this SAP vulnerability to achieve remote code execution on the target system by sending malicious ZIP files to specific server endpoints. This can be done either through use of a single command or by uploading a web shell.","confidence":"high"},{"id":"T1602","name":"Data from Configuration Repository","tactics":["collection"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Unrestricted File Upload","mappingType":"secondary_impact","evidence":[],"comment":"Attackers have exploited this SAP vulnerability to achieve remote code execution on the target system by sending malicious ZIP files to specific server endpoints. This can be done either through use of a single command or by uploading a web shell.","confidence":"high"}],"reports":[{"id":"SRC-c394fa88286c8c1f33ff","title":"Secure Cloud Analytics Alerts and Observations Reference Guide","publisher":"cisco.com","url":"https://www.cisco.com/c/dam/en/us/td/docs/security/stealthwatch/cloud/reference/Alerts_and_Observations_DV_4_13.pdf","date":null,"mentions":[{"quote":"65\r\nEmailSpam 66\r\nEmergentProfile 66\r\nEmpireCommandandControl 67\r\nEndpointExfiltrationofAWSCredentials 68\r\nExcessiveAccessAttempts(External) 68\r\nExcessiveConnectionstoNetworkPrinters 69\r\nExecutionofAdFindBinaryforDiscovery 70\r\nExecutionsofFilefromRecycleBin 70\r\nExploitationofWebShellthroughCVE-2025-31324","start":3189,"end":3494},{"quote":"ExploitationofWebShellthroughCVE-2025-31324","start":84373,"end":84416},{"quote":"ContentDownloadUsingPowershell\r\nl DataExfiltrationusingrclone\r\nl DCSyncAttackBehavior\r\nl DLLFileConnectedtoaRawIPAddress\r\nl DownloadofExecutableFilesusingWebDAV\r\nl EndpointExfiltrationofAWSCredentials\r\nl ExecutionofAdFindBinaryforDiscovery\r\nl ExecutionsofFilefromRecycleBin\r\nl ExploitationofWebShellthroughCVE-2025-31324","start":223449,"end":223769},{"quote":"ss\r\nl NewActiveDirectoryHiddenUserAccount\r\nAdded\r\nl NTLMRelayExploitationviaInveigh\r\nl ResidentialProxyApplicationUtilized\r\nl SuspiciousUseofDiscoveryTools\r\n4.9 May29,2025\r\nAddedthefollowingalerts:\r\nl AWSPotentialPrivilegeEscalation\r\nl CertifyActiveDirectoryCSEnumeration\r\nl ExploitationofWebShellthroughCVE-2025-\r\n31324","start":244594,"end":244914}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-11987","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-11987","exploited":true,"exploitedSince":"2025-04-29","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":21,"skipped":2,"earliest":"2025-04-25","earliestUrl":"https://github.com/rxerium/CVE-2025-31324","repos":[{"name":"redrays-io/CVE-2025-31324","url":"https://github.com/redrays-io/CVE-2025-31324","stars":25,"created":"2025-04-27"},{"name":"antichainalysis/sap-netweaver-0day-CVE-2025-31324","url":"https://github.com/antichainalysis/sap-netweaver-0day-CVE-2025-31324","stars":21,"created":"2025-08-15"},{"name":"Onapsis/Onapsis_CVE-2025-31324_Scanner_Tools","url":"https://github.com/Onapsis/Onapsis_CVE-2025-31324_Scanner_Tools","stars":12,"created":"2025-04-27"},{"name":"Onapsis/Onapsis-Mandiant-CVE-2025-31324-Vuln-Compromise-Assessment","url":"https://github.com/Onapsis/Onapsis-Mandiant-CVE-2025-31324-Vuln-Compromise-Assessment","stars":9,"created":"2025-05-01"},{"name":"NULLTRACE0X/CVE-2025-31324","url":"https://github.com/NULLTRACE0X/CVE-2025-31324","stars":9,"created":"2025-05-07"}]},"nuclei":[{"id":"CVE-2025-31324","name":"SAP NetWeaver Visual Composer Metadata Uploader - Deserialization","severity":"critical","path":"http/cves/2025/CVE-2025-31324.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-31324.yaml"}],"first":{"date":"2025-04-25","source":"PoC-in-GitHub","url":"https://github.com/rxerium/CVE-2025-31324"},"provenance":"source"},"detections":{"cveRules":[{"title":"Potential Java WebShell Upload in SAP NetViewer Server","id":"639b893f-f93a-4e53-a7c8-f08cf73fe7f7","level":"high","status":"experimental","path":"rules-emerging-threats/2025/Exploits/CVE-2025-31324/web_lnx_exploit_cve_2025_31324_sap_netviewer_webshell_uploaded.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-31324/web_lnx_exploit_cve_2025_31324_sap_netviewer_webshell_uploaded.yml","techniques":["T1505.003"]},{"title":"Potential SAP NetViewer Webshell Command Execution","id":"94e12f41-6cb3-45c5-97b1-c783a7bf2e72","level":"high","status":"experimental","path":"rules-emerging-threats/2025/Exploits/CVE-2025-31324/web_lnx_exploit_cve_2025_31324_sap_netviewer_webshell.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-31324/web_lnx_exploit_cve_2025_31324_sap_netviewer_webshell.yml","techniques":["T1505.003","T1190"]},{"title":"Potential SAP NetWeaver Webshell Creation","id":"86a7c91f-98c3-4f14-a58d-d989421e1234","level":"medium","status":"experimental","path":"rules-emerging-threats/2025/Exploits/CVE-2025-31324/file_event_win_sap_netweaver_webshell_creation.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-31324/file_event_win_sap_netweaver_webshell_creation.yml","techniques":["T1190","T1059.003"]},{"title":"Potential SAP NetWeaver Webshell Creation - Linux","id":"5b91409c-cb18-4ab6-ac75-c5759f998409","level":"medium","status":"experimental","path":"rules-emerging-threats/2025/Exploits/CVE-2025-31324/file_event_lnx_sap_netweaver_webshell_creation.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-31324/file_event_lnx_sap_netweaver_webshell_creation.yml","techniques":["T1190","T1059.003"]},{"title":"Suspicious Child Process of SAP NetWeaver","id":"5b304bcb-ac33-49d0-87af-fa1b3ca94333","level":"medium","status":"experimental","path":"rules-emerging-threats/2025/Exploits/CVE-2025-31324/proc_creation_win_sap_netweaver_susp_child_process.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-31324/proc_creation_win_sap_netweaver_susp_child_process.yml","techniques":["T1190","T1059.003"]},{"title":"Suspicious Child Process of SAP NetWeaver - Linux","id":"69dea60b-2deb-4c9e-a685-ad542f4367f9","level":"medium","status":"experimental","path":"rules-emerging-threats/2025/Exploits/CVE-2025-31324/proc_creation_lnx_sap_netweaver_susp_child_process.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-31324/proc_creation_lnx_sap_netweaver_susp_child_process.yml","techniques":["T1190","T1059.003"]}]},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1505.003","T1055"],"provenance":"source"},{"stage":"primary","techniques":["T1059"],"provenance":"source"},{"stage":"secondary","techniques":["T1602"],"provenance":"source"}],"timeline":[{"date":"2025-04-22","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/","provenance":"source"},{"date":"2025-04-24","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-31324","provenance":"source"},{"date":"2025-04-25","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/rxerium/CVE-2025-31324","provenance":"source"},{"date":"2025-04-29","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-04-29","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-11987","provenance":"source"}],"speed":{"daysToPublicExploit":1,"firstExploitFrom":"PoC-in-GitHub","daysToKev":5},"priority":{"score":83.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 556 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9994"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"21 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}