CVE-2025-31324
📋 TL;DR
CVE-2025-31324 is an unauthenticated remote code execution vulnerability in SAP NetWeaver Visual Composer Metadata Uploader that allows attackers to upload malicious binaries and execute arbitrary code on affected systems. This affects organizations running vulnerable SAP NetWeaver installations, particularly those with internet-facing components. The vulnerability bypasses authorization checks entirely, requiring no authentication.
💻 Affected Systems
- SAP NetWeaver Visual Composer
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to execute arbitrary code, steal sensitive data, deploy ransomware, pivot to other systems, and cause permanent system damage.
Likely Case
Attackers upload webshells or malware to establish persistent access, exfiltrate business data, and use compromised systems for lateral movement within the network.
If Mitigated
With proper network segmentation and access controls, impact is limited to the affected SAP system, though data theft and service disruption remain possible.
🎯 Exploit Status
Actively exploited in the wild as a zero-day before patching. Attackers only need to craft HTTP requests to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply SAP Security Note 3594142
Vendor Advisory: https://me.sap.com/notes/3594142
Restart Required: Yes
Instructions:
1. Download SAP Security Note 3594142 from SAP Support Portal. 2. Apply the patch following SAP's standard patching procedures. 3. Restart affected SAP NetWeaver systems. 4. Verify the patch is applied correctly.
🔧 Temporary Workarounds
Network Access Control
allBlock external access to SAP NetWeaver Visual Composer endpoints
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="0.0.0.0/0" port port="<SAP_PORT>" protocol="tcp" reject'
netsh advfirewall firewall add rule name="Block SAP VC" dir=in action=block protocol=TCP localport=<SAP_PORT>
Disable Vulnerable Component
allTemporarily disable Visual Composer Metadata Uploader if not required
Consult SAP documentation for component-specific disable procedures
🧯 If You Can't Patch
- Implement strict network segmentation to isolate SAP systems from internet and untrusted networks
- Deploy web application firewall (WAF) with rules to block suspicious upload requests to SAP endpoints
🔍 How to Verify
Check if Vulnerable:
Check if SAP Security Note 3594142 is applied in SAP system. Review system logs for unauthorized upload attempts to /sap/bc/vc/ endpoints.Check Version:
In SAP GUI: System → Status → check installed SAP NotesVerify Fix Applied:
Verify SAP Security Note 3594142 appears as successfully implemented in SAP system. Test that unauthenticated uploads to Visual Composer endpoints are now properly rejected.📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /sap/bc/vc/* upload endpoints from unauthenticated sources
- Unusual file uploads to SAP system directories
- New executable files in SAP server filesystem
Network Indicators:
- Unusual outbound connections from SAP servers
- HTTP traffic to SAP ports from unexpected sources
- Large file uploads to SAP endpoints
SIEM Query:
source="sap_logs" AND (uri_path="/sap/bc/vc/*" AND http_method="POST") AND user="anonymous"🔗 References
- https://me.sap.com/notes/3594142
- https://url.sap/sapsecuritypatchday
- https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/
- https://www.bleepingcomputer.com/news/security/sap-fixes-suspected-netweaver-zero-day-exploited-in-attacks/
- https://www.theregister.com/2025/04/25/sap_netweaver_patch/
- https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31324
