---
title: "SAP NetWeaver Visual Composer: Unauthenticated Upload RCE"
url: https://erroneo.us/security/briefs/sap-netweaver-visual-composer-cve-2025-31324/
description: "CVE-2025-31324 (CVSS 10) let anyone upload webshells to SAP NetWeaver Java via Visual Composer; chained with CVE-2025-42999. Patched 2025. Verify and hunt."
type: security-brief
section: "Security Digest"
date_published: 2025-04-24
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2025-31324", "CVE-2025-42999"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# SAP NetWeaver Visual Composer: Unauthenticated Upload RCE

**Verdict: Check exposure.** Patches have existed since April and May 2025, but this was a mass-exploited zero-day used by ransomware crews, so every SAP Java shop should confirm the fix and hunt for leftover webshells.

- **Who must act:** Anyone running SAP NetWeaver Java with the Visual Composer framework installed, especially if it was internet-reachable during 2025 or is still on unsupported NetWeaver 7.0.
- **Who can relax:** SAP ABAP-only landscapes, systems without the VCFRAMEWORK component, and teams who patched both notes and already ran a compromise assessment.
- **Affected:** SAP NetWeaver Visual Composer development server (VCFRAMEWORK 7.50) without SAP Security Notes 3594142 and 3604119; NetWeaver Java 7.0 with Visual Composer (out of support, no patch)
- **Fixed:** SAP Security Note 3594142 (CVE-2025-31324, April 24, 2025); SAP Security Note 3604119 (CVE-2025-42999, May 13, 2025)
- **CVEs:** CVE-2025-31324, CVE-2025-42999
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Check the Java component list for VISUAL COMPOSER FRAMEWORK / VCFRAMEWORK on every NetWeaver Java system
2. Confirm SAP Security Notes 3594142 and 3604119 are applied
3. If you cannot patch, follow SAP Note 3593336: disable Visual Composer or block the /developmentserver/metadatauploader path
4. Run the open-source Onapsis-Mandiant compromise assessment scanner against each system
5. If anything is found, treat the host as compromised: rotate SAP and OS credentials and widen the investigation before cleanup

### How to check if you are affected

- Look for unexpected .jsp, .java or .class files under servlet_jsp/irj/root, irj/work and irj/work/sync (e.g. helper.jsp, cache.jsp, random 8-character names)
- Search HTTP access logs for POST requests to /developmentserver/metadatauploader
- Look for child processes of the SAP Java server process and for serialized Java objects in uploaded files (CVE-2025-42999 chain)
- Check outbound connections to known IOCs listed by ReliaQuest

## What happened

On April 24, 2025, SAP published an emergency fix for CVE-2025-31324. The flaw is in the Metadata Uploader of SAP NetWeaver Visual Composer, which had no proper authorization check. Anyone who could reach it could upload "potentially malicious executable binaries" to the host, according to the [CVE record](https://cveawg.mitre.org/api/cve/CVE-2025-31324). SAP, acting as CNA, scored it CVSS 3.1 10.0.

By then the bug was already a zero-day. [ReliaQuest](https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/) published its investigation of compromised NetWeaver systems on April 22. Attackers sent crafted POST requests to `/developmentserver/metadatauploader`, dropped JSP webshells such as `helper.jsp` and `cache.jsp`, and then ran commands through them with GET requests. Rapid7 traced exploitation back to at least March 27, 2025, as reported by [Help Net Security](https://www.helpnetsecurity.com/2025/04/28/sap-netweaver-cve-2025-31324-exploited/). [Onapsis](https://onapsis.com/threat-research/cve-2025-31324/) says it saw related reconnaissance as early as January 2025.

On May 13, 2025, SAP patched a second flaw in the same component. CVE-2025-42999 (CVSS 9.1) is a deserialization bug that a privileged user can trigger, per its [CVE record](https://cveawg.mitre.org/api/cve/CVE-2025-42999). Chained together, the two bugs let an unauthenticated attacker run OS commands in memory with SAP `adm` privileges. In August 2025, a working chain exploit appeared on a Telegram channel that claimed to speak for "Scattered LAPSUS$ Hunters" ([Help Net Security](https://www.helpnetsecurity.com/2025/08/20/cve-2025-31324-cve-2025-42999-sap-netweaver-exploit-public/)). ReliaQuest later linked follow-on activity to BianLian (moderate confidence) and RansomEXX.

## Who is affected

Only SAP NetWeaver Application Server Java systems with the Visual Composer framework (VCFRAMEWORK 7.50) are affected. Visual Composer is not installed by default, but Onapsis estimates it is enabled on roughly 50 to 70 percent of SAP Java systems. Solution Manager 7.2 is affected only if the framework was installed. NetWeaver Java 7.0 with Visual Composer is out of support and will not get a patch. SAP points those customers to the mitigation in Note 3593336. ABAP-only systems are not affected.

## Do you really need to act?

Patches have been out for 18 months, so the main risk today is not a new attack. It is an old compromise nobody found. This was a CVSS 10 bug, exploited before the fix, and it gave attackers administrator-level access to systems that sit on finance and manufacturing data. Patching did not remove webshells planted before the fix. ReliaQuest says to remove suspicious files before applying mitigations, because existing shells keep working.

Exposure was narrower than the headlines suggested. Shadowserver counted about 450 vulnerable internet-facing instances in late April and fewer than 50 unpatched ones by August 19, 2025. Systems reachable only from internal networks were still at risk from any attacker who already had a foothold inside. The verdict is **check-exposure**: confirm both notes are applied and run a compromise assessment once. If you still run an unpatched VCFRAMEWORK, treat this as act-now.

## What to do now

1. List every NetWeaver Java system and check its component list for `VISUAL COMPOSER FRAMEWORK` or `VCFRAMEWORK`.
2. Confirm SAP Security Notes 3594142 and 3604119 are implemented. Visual Composer has been deprecated since 2015, so if nobody uses it, disable it as well.
3. If you cannot patch, follow SAP Note 3593336: disable the `developmentserver` alias, or block `/developmentserver/metadatauploader` at the edge.
4. Run the open-source Onapsis-Mandiant assessment tool (linked from the Onapsis page). It checks patch status and looks for known webshells.
5. If you find indicators, isolate the host, preserve logs, rotate SAP and OS credentials, and look for lateral movement before you rebuild.

## How to tell if you were hit

Look for any JSP, Java or class file in `j2ee/cluster/apps/sap.com/irj/servlet_jsp/irj/root/`, `irj/work` or `irj/work/sync` that you did not deploy. Names seen in the wild include `helper.jsp`, `cache.jsp`, `rrx.jsp` and random eight-character names. Search web logs for POST requests to `/developmentserver/metadatauploader` and for GET requests to unfamiliar JSP files. Attacks that use the CVE-2025-42999 chain run in memory and may leave no file behind. For those, look for unusual child processes of the SAP Java server, and check egress logs against the IOCs ReliaQuest published (for example `184.174.96[.]74`). One intrusion used Brute Ratel and the Heaven's Gate technique.

## Timeline

- Jan 2025 — Onapsis reports related reconnaissance activity.
- Mar 27, 2025 — Earliest exploitation observed by Rapid7.
- Apr 22, 2025 — ReliaQuest publishes its investigation of compromised NetWeaver systems.
- Apr 24, 2025 — SAP releases Note 3594142; CVE-2025-31324 is published.
- Apr 29, 2025 — CISA adds CVE-2025-31324 to KEV.
- May 13, 2025 — SAP releases Note 3604119 for CVE-2025-42999.
- May 15, 2025 — CISA adds CVE-2025-42999 to KEV.
- Aug 15, 2025 — Chain exploit posted on Telegram.

## Sources

1. [CVE Program — CVE-2025-31324 record (JSON)](https://cveawg.mitre.org/api/cve/CVE-2025-31324)
2. [CVE Program — CVE-2025-42999 record (JSON)](https://cveawg.mitre.org/api/cve/CVE-2025-42999)
3. [ReliaQuest — Threat Spotlight: ReliaQuest uncovers vulnerability behind SAP NetWeaver compromise](https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/)
4. [Onapsis — Protecting Against Zero Day SAP Vulnerabilities: CVE-2025-31324 & CVE-2025-42999](https://onapsis.com/threat-research/cve-2025-31324/)
5. [Help Net Security — Critical SAP NetWeaver flaw exploited by suspected initial access broker](https://www.helpnetsecurity.com/2025/04/28/sap-netweaver-cve-2025-31324-exploited/)
6. [Help Net Security — Exploit for critical SAP NetWeaver flaws released](https://www.helpnetsecurity.com/2025/08/20/cve-2025-31324-cve-2025-42999-sap-netweaver-exploit-public/)

---
Source page: https://erroneo.us/security/briefs/sap-netweaver-visual-composer-cve-2025-31324/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt