Security Digest · Apr 24, 2025 · Vulnerability · Other
SAP NetWeaver Visual Composer: Unauthenticated Upload RCE
CVE-2025-31324 (CVSS 10) let anyone upload webshells to SAP NetWeaver Java via Visual Composer; chained with CVE-2025-42999. Patched 2025. Verify and hunt.
Our verdict
Check exposure
Patches have existed since April and May 2025, but this was a mass-exploited zero-day used by ransomware crews, so every SAP Java shop should confirm the fix and hunt for leftover webshells.
Who must act: Anyone running SAP NetWeaver Java with the Visual Composer framework installed, especially if it was internet-reachable during 2025 or is still on unsupported NetWeaver 7.0.
Who can relax: SAP ABAP-only landscapes, systems without the VCFRAMEWORK component, and teams who patched both notes and already ran a compromise assessment.
- Affected
- SAP NetWeaver Visual Composer development server (VCFRAMEWORK 7.50) without SAP Security Notes 3594142 and 3604119
NetWeaver Java 7.0 with Visual Composer (out of support, no patch) - Fixed in
- SAP Security Note 3594142 (CVE-2025-31324, April 24, 2025)
SAP Security Note 3604119 (CVE-2025-42999, May 13, 2025) - CVSS
- 10.0 (v3.1, CNA)
- EPSS
- 99.5% (percentile 99.9)
- CISA KEV
- Yes, listed as known exploited
- Exploitation
- Exploited in the wild
- Severity
- Critical
What to do
- Check the Java component list for VISUAL COMPOSER FRAMEWORK / VCFRAMEWORK on every NetWeaver Java system
- Confirm SAP Security Notes 3594142 and 3604119 are applied
- If you cannot patch, follow SAP Note 3593336: disable Visual Composer or block the /developmentserver/metadatauploader path
- Run the open-source Onapsis-Mandiant compromise assessment scanner against each system
- If anything is found, treat the host as compromised: rotate SAP and OS credentials and widen the investigation before cleanup
How to check if you are affected or compromised
- Look for unexpected .jsp, .java or .class files under servlet_jsp/irj/root, irj/work and irj/work/sync (e.g. helper.jsp, cache.jsp, random 8-character names)
- Search HTTP access logs for POST requests to /developmentserver/metadatauploader
- Look for child processes of the SAP Java server process and for serialized Java objects in uploaded files (CVE-2025-42999 chain)
- Check outbound connections to known IOCs listed by ReliaQuest
What happened#
On April 24, 2025, SAP published an emergency fix for CVE-2025-31324. The flaw is in the Metadata Uploader of SAP NetWeaver Visual Composer, which had no proper authorization check. Anyone who could reach it could upload "potentially malicious executable binaries" to the host, according to the CVE record. SAP, acting as CNA, scored it CVSS 3.1 10.0.
By then the bug was already a zero-day. ReliaQuest published its investigation of compromised NetWeaver systems on April 22. Attackers sent crafted POST requests to /developmentserver/metadatauploader, dropped JSP webshells such as helper.jsp and cache.jsp, and then ran commands through them with GET requests. Rapid7 traced exploitation back to at least March 27, 2025, as reported by Help Net Security. Onapsis says it saw related reconnaissance as early as January 2025.
On May 13, 2025, SAP patched a second flaw in the same component. CVE-2025-42999 (CVSS 9.1) is a deserialization bug that a privileged user can trigger, per its CVE record. Chained together, the two bugs let an unauthenticated attacker run OS commands in memory with SAP adm privileges. In August 2025, a working chain exploit appeared on a Telegram channel that claimed to speak for "Scattered LAPSUS$ Hunters" (Help Net Security). ReliaQuest later linked follow-on activity to BianLian (moderate confidence) and RansomEXX.
Who is affected#
Only SAP NetWeaver Application Server Java systems with the Visual Composer framework (VCFRAMEWORK 7.50) are affected. Visual Composer is not installed by default, but Onapsis estimates it is enabled on roughly 50 to 70 percent of SAP Java systems. Solution Manager 7.2 is affected only if the framework was installed. NetWeaver Java 7.0 with Visual Composer is out of support and will not get a patch. SAP points those customers to the mitigation in Note 3593336. ABAP-only systems are not affected.
Do you really need to act?#
Patches have been out for 18 months, so the main risk today is not a new attack. It is an old compromise nobody found. This was a CVSS 10 bug, exploited before the fix, and it gave attackers administrator-level access to systems that sit on finance and manufacturing data. Patching did not remove webshells planted before the fix. ReliaQuest says to remove suspicious files before applying mitigations, because existing shells keep working.
Exposure was narrower than the headlines suggested. Shadowserver counted about 450 vulnerable internet-facing instances in late April and fewer than 50 unpatched ones by August 19, 2025. Systems reachable only from internal networks were still at risk from any attacker who already had a foothold inside. The verdict is check-exposure: confirm both notes are applied and run a compromise assessment once. If you still run an unpatched VCFRAMEWORK, treat this as act-now.
What to do now#
- List every NetWeaver Java system and check its component list for
VISUAL COMPOSER FRAMEWORKorVCFRAMEWORK. - Confirm SAP Security Notes 3594142 and 3604119 are implemented. Visual Composer has been deprecated since 2015, so if nobody uses it, disable it as well.
- If you cannot patch, follow SAP Note 3593336: disable the
developmentserveralias, or block/developmentserver/metadatauploaderat the edge. - Run the open-source Onapsis-Mandiant assessment tool (linked from the Onapsis page). It checks patch status and looks for known webshells.
- If you find indicators, isolate the host, preserve logs, rotate SAP and OS credentials, and look for lateral movement before you rebuild.
How to tell if you were hit#
Look for any JSP, Java or class file in j2ee/cluster/apps/sap.com/irj/servlet_jsp/irj/root/, irj/work or irj/work/sync that you did not deploy. Names seen in the wild include helper.jsp, cache.jsp, rrx.jsp and random eight-character names. Search web logs for POST requests to /developmentserver/metadatauploader and for GET requests to unfamiliar JSP files. Attacks that use the CVE-2025-42999 chain run in memory and may leave no file behind. For those, look for unusual child processes of the SAP Java server, and check egress logs against the IOCs ReliaQuest published (for example 184.174.96[.]74). One intrusion used Brute Ratel and the Heaven's Gate technique.
Timeline#
- — Onapsis reports related reconnaissance activity.
- — Earliest exploitation observed by Rapid7.
- — ReliaQuest publishes its investigation of compromised NetWeaver systems.
- — SAP releases Note 3594142; CVE-2025-31324 is published.
- — CISA adds CVE-2025-31324 to KEV.
- — SAP releases Note 3604119 for CVE-2025-42999.
- — CISA adds CVE-2025-42999 to KEV.
- — Chain exploit posted on Telegram.
Vulnerability records
- CVE-2025-31324 · KEV 2025-04-29 · SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious…
- CVE-2025-42999 · KEV 2025-05-15 · SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could…
Sources
Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.
Original and primary sources
- CVE Program — CVE-2025-31324 record (JSON) cveawg.mitre.org
- CVE Program — CVE-2025-42999 record (JSON) cveawg.mitre.org
- ReliaQuest — Threat Spotlight: ReliaQuest uncovers vulnerability behind SAP NetWeaver compromise reliaquest.com
- Onapsis — Protecting Against Zero Day SAP Vulnerabilities: CVE-2025-31324 & CVE-2025-42999 onapsis.com