In the realm of cybersecurity, SAP systems have recently come under intense scrutiny due to the discovery of a critical zero-day vulnerability identified as CVE-2025-31324. This vulnerability, which has been exploited in the wild, poses a severe risk to organizations operating SAP NetWeaver environments. With a maximum CVSS score of 10.0, the vulnerability emanates from inadequate authorization checks within the Metadata Uploader component of the Visual Composer. This flaw enables malicious actors to upload harmful files through certain POST requests targeting the /developmentserver/metadatauploader endpoint. Such an exploit places organizations at the mercy of cybercriminals, threatening to compromise their entire SAP infrastructure. Despite Visual Composer not being a default component in NetWeaver, its widespread activation by business specialists has led to increased exposure. Consequently, many organizations find themselves grappling with potential risks that could impact their operational integrity.
Understanding the Threat
The vulnerability in SAP NetWeaver allows attackers to deploy JSP webshells, specifically targeting directories with public access permissions. Webshells like helper.jsp and cache.jsp provide attackers with the means to execute commands using
Mitigation and Response
Faced with the critical nature of this zero-day vulnerability, SAP has responded promptly by releasing an emergency patch. Immediate application of this patch is strongly advised by SAP for all affected users to safeguard their systems. In addition to deploying the patch, it is crucial for organizations to restrict access to the development server’s endpoint that is vulnerable to exploitation. Disabling the Visual Composer altogether can be a temporary protective measure if the component is not essential for current operations. Onapsis has developed an open-source scanner available on GitHub to assist organizations in identifying vulnerable systems quickly. This tool underscores the importance of immediate action to mitigate the risk of exploitation. While proactively addressing the vulnerability, companies should also bolster their overall cybersecurity posture by revisiting network configurations and enhancing monitoring capabilities. Vigilance and quick adaptation to security patches are crucial measures to counteract the ongoing threat landscape in SAP environments.
The Implications of Inaction
A vulnerability in SAP NetWeaver exposes systems to attackers who can install JSP webshells, specifically targeting directories with public access permissions. These webshells, such as helper.jsp and cache.jsp, empower attackers to run commands using