CVE-2025-31324

Name of the Vulnerable Software and Affected Versions SAP NetWeaver versions prior to September 2025

Description An issue in the MetadataUploader function of the Visual Composer tool within the SAP NetWeaver platform allows unauthenticated remote attackers to upload unrestricted executable binaries. This is caused by inadequate validation of model files and flaws in the deserialization mechanism. Attackers can send specially crafted HTTP POST requests containing malicious ZIP or JAR files (often as application/octet-stream), which the server erroneously processes as safe content, leading to remote code execution (RCE) and full system compromise. Real-world exploitation has been documented, including activities by China-nexus APTs and groups such as Lapsus and Shinyhunters. These attacks have involved the deployment of web shells (e.g., helper.jsp and cache.jsp) and a Linux backdoor named Auto-Color to maintain persistent access, steal data, and move laterally within networks.

Recommendations Apply SAP security updates released in September 2025. Deploy intrusion prevention and detection systems (IPS/IDS) to identify POST requests to the metadatauploader endpoint containing application/octet-stream indications and binary payloads. Use endpoint detection and response (EDR) solutions to monitor for anomalous SAP process behaviors, such as unexpected command line executions. Restrict exposure of development servers to trusted networks.