erroneo.us
Search all guides⌘K

Digest · Thursday

Security digest: April 24, 2025

1 editorial brief and 1 critical advisory.

All digests · RSS · Markdown

Take stock

  • Check exposure: SAP NetWeaver Visual Composer: Unauthenticated Upload RCE. Anyone running SAP NetWeaver Java with the Visual Composer framework installed, especially if it was internet-reachable during 2025 or is still on unsupported NetWeaver 7.0.
  • PyPI: 1 critical advisory (h11). Check with pip-audit (or: pip show <package>).
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

· Vulnerability · CVE-2025-31324, CVE-2025-42999

SAP NetWeaver Visual Composer: Unauthenticated Upload RCE

Patches have existed since April and May 2025, but this was a mass-exploited zero-day used by ransomware crews, so every SAP Java shop should confirm the fix and hunt for leftover webshells.

Must act: Anyone running SAP NetWeaver Java with the Visual Composer framework installed, especially if it was internet-reachable during 2025 or is still on unsupported NetWeaver 7.0.

Can relax: SAP ABAP-only landscapes, systems without the VCFRAMEWORK component, and teams who patched both notes and already ran a compromise assessment.

  1. Check the Java component list for VISUAL COMPOSER FRAMEWORK / VCFRAMEWORK on every NetWeaver Java system
  2. Confirm SAP Security Notes 3594142 and 3604119 are applied
  3. If you cannot patch, follow SAP Note 3593336: disable Visual Composer or block the /developmentserver/metadatauploader path

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 1

GitHub-reviewed advisories rated critical, published this day (Pacific time).

PyPI 1

Check: pip-audit (or: pip show <package>)