CVE-2025-31324

10.0

CRITICAL

SAP NetWeaver Unrestricted File Upload Vulnerabili - [Actively Exploited]

Description

SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system.

INFO

Published Date :

April 24, 2025, 5:15 p.m.

Last Modified :

May 6, 2025, 8:59 p.m.

Source :

[email protected]

Remotely Exploitable :

Yes !

Impact Score :

6.0

Exploitability Score :

3.9

CISA Notification

CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Due Date: May 20, 2025

Alert Date: Apr 29, 2025 | 24 days ago

Description :

SAP NetWeaver Visual Composer Metadata Uploader contains an unrestricted file upload vulnerability that allows an unauthenticated agent to upload potentially malicious executable binaries.

Required Action :

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes :

https://me.sap.com/notes/3594142 ; https://nvd.nist.gov/vuln/detail/CVE-2025-31324

Public PoC/Exploit Available at Github

CVE-2025-31324 has a 28 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

Affected Products

The following products are affected by CVE-2025-31324 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product	Action
1	Sap	netweaver

: Total Affected Vendor : 1 | Products : 1

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2025-31324.

URL	Resource
https://me.sap.com/notes/3594142	Permissions Required
https://url.sap/sapsecuritypatchday	Vendor Advisory
https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/	Third Party Advisory
https://www.bleepingcomputer.com/news/security/sap-fixes-suspected-netweaver-zero-day-exploited-in-attacks/	Press/Media Coverage
https://www.theregister.com/2025/04/25/sap_netweaver_patch/	Press/Media Coverage
https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/	Third Party Advisory

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

sug4r-wr41th/CVE-2025-31324

SAP NetWeaver Visual Composer Metadata Uploader 7.50 CVE-2025-31324 PoC

Python

Updated: 1 week, 5 days ago

0 stars 0 fork 0 watcher

Born at : May 10, 2025, 6:52 p.m. This repo has been linked 1 different CVEs too.

nairuzabulhul/nuclei-template-cve-2025-31324-check

sap-netweaver-cve-2025-31324-check

Updated: 1 week, 4 days ago

0 stars 0 fork 0 watcher

Born at : May 8, 2025, 12:57 a.m. This repo has been linked 1 different CVEs too.

NULLTRACE0X/CVE-2025-31324

None

Python Java

Updated: 2 weeks, 1 day ago

2 stars 1 fork 1 watcher

Born at : May 7, 2025, 6:23 a.m. This repo has been linked 1 different CVEs too.

rf-peixoto/sap_netweaver_cve-2025-31324-

Research Purposes only

Java Python

Updated: 2 weeks, 1 day ago

2 stars 0 fork 0 watcher

Born at : May 6, 2025, 4:58 p.m. This repo has been linked 1 different CVEs too.

Onapsis/Onapsis-Mandiant-CVE-2025-31324-Vuln-Compromise-Assessment

CVE-2025-31324 vulnerability and compromise assessment tool

Python

Updated: 2 weeks, 1 day ago

1 stars 0 fork 0 watcher

Born at : May 1, 2025, 6:44 p.m. This repo has been linked 1 different CVEs too.

JonathanStross/CVE-2025-31324

A Python-based security scanner for identifying the CVE-2025-31324 vulnerability in SAP Visual Composer systems, and detecting known Indicators of Compromise (IOCs) such as malicious .jsp.

Python

Updated: 2 weeks, 2 days ago

0 stars 0 fork 0 watcher

Born at : April 30, 2025, 10:31 p.m. This repo has been linked 1 different CVEs too.

respondiq/jsp-webshell-scanner

🔍 A simple Bash script to detect malicious JSP webshells, including those used in exploits of SAP NetWeaver CVE-2025-31324.

Shell PowerShell

Updated: 3 weeks, 1 day ago

0 stars 0 fork 0 watcher

Born at : April 30, 2025, 3:38 p.m. This repo has been linked 1 different CVEs too.

nullcult/CVE-2025-31324-File-Upload

A totally unauthenticated file-upload endpoint in Visual Composer lets anyone drop arbitrary files (e.g., a JSP web-shell) onto the server.

Java Python

Updated: 2 weeks, 3 days ago

1 stars 0 fork 0 watcher

Born at : April 30, 2025, 1:39 p.m. This repo has been linked 1 different CVEs too.

BlueOWL-overlord/Burp_CVE-2025-31324

Python-based Burp Suite extension is designed to detect the presence of CVE-2025-31324

Python

Updated: 3 weeks ago

0 stars 0 fork 0 watcher

Born at : April 30, 2025, 6:34 a.m. This repo has been linked 1 different CVEs too.

Pengrey/CVE-2025-31324

Unauthenticated upload in SAP NetWeaver Visual Composer Metadata Uploader

Python

Updated: 3 weeks, 2 days ago

0 stars 0 fork 0 watcher

Born at : April 29, 2025, 9:46 a.m. This repo has been linked 1 different CVEs too.

abrewer251/CVE-2025-31324_PoC_SAP

Proof-of-Concept for CVE-2025-31324: Unauthenticated upload in SAP NetWeaver Visual Composer Metadata Uploader

Java Python Shell

Updated: 3 weeks, 3 days ago

0 stars 0 fork 0 watcher

Born at : April 29, 2025, 12:16 a.m. This repo has been linked 1 different CVEs too.

ODST-Forge/CVE-2025-31324_PoC

Proof-of-Concept for CVE-2025-31324: Unauthenticated upload in SAP NetWeaver Visual Composer Metadata Uploader

Python Java Shell

Updated: 3 weeks, 3 days ago

0 stars 0 fork 0 watcher

Born at : April 28, 2025, 8:32 p.m. This repo has been linked 1 different CVEs too.

Alizngnc/SAP-CVE-2025-31324

SAP NetWeaver Unauthenticated Remote Code Execution

Python

Updated: 3 weeks, 3 days ago

0 stars 0 fork 0 watcher

Born at : April 28, 2025, 1:19 p.m. This repo has been linked 1 different CVEs too.

moften/CVE-2025-31324-NUCLEI

Nuclei template for cve-2025-31324 (SAP)

Updated: 3 weeks, 4 days ago

0 stars 0 fork 0 watcher

Born at : April 28, 2025, 1:43 a.m. This repo has been linked 1 different CVEs too.

moften/CVE-2025-31324

SAP PoC para CVE-2025-31324

netweaver sap cve-2025-31324

Python

Updated: 2 weeks, 2 days ago

0 stars 0 fork 0 watcher

Born at : April 28, 2025, 1:32 a.m. This repo has been linked 1 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2025-31324 vulnerability anywhere in the article.

The Hacker News

Chinese Hackers Exploit SAP RCE Flaw CVE-2025-31324, Deploy Golang-Based SuperShell

Vulnerability / Industrial Security A China-linked unnamed threat actor dubbed Chaya_004 has been observed exploiting a recently disclosed security flaw in SAP NetWeaver. Forescout Vedere Labs, in a r ...

Published Date: May 09, 2025 (2 weeks ago)

CVE-2025-31324 CVE-2025-27363

Dark Reading

'Easily Exploitable' Langflow Vulnerability Requires Immediate Patching

Source: Alexey Kotelnikov via Alamy Stock PhotoNEWS BRIEFA critical flaw found in the open source Langflow platform was added to the US Cybersecurity and Infrastructure Security Agency’s (CISA's) Know ...

Published Date: May 06, 2025 (2 weeks, 2 days ago)

CVE-2025-31324 CVE-2025-3248

Dark Reading

CISA Warns 2 SonicWall Vulnerabilities Under Active Exploitation

Source: ktdesign via Alamy Stock PhotoNEWS BRIEFCISA added two older SonicWall bugs to the Known Exploited Vulnerabilities (KEV) catalog, marking the latest threat activity targeting the network secur ...

Published Date: May 06, 2025 (2 weeks, 2 days ago)

CVE-2025-31324 CVE-2025-23006 CVE-2024-38475 CVE-2023-44221

The Register

Microsoft tries to knife passwords once and for all - at least for consumers

Infosec In Brief Microsoft has decided to push its consumer customers to dump password in favor of passkeys. The software giant announced the move Thursday, May 1, traditionally known as "World Passwo ...

Published Date: May 04, 2025 (2 weeks, 4 days ago)

CVE-2025-3928 CVE-2025-31324 CVE-2025-1976 CVE-2025-42599 CVE-2024-38475

Help Net Security

Week in review: Critical SAP NetWeaver flaw exploited, RSAC 2025 Conference

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: RSAC 2025 Conference RSAC 2025 Conference took place at the Moscone Center in San Francisco. Check out ...

Published Date: May 04, 2025 (2 weeks, 5 days ago)

CVE-2025-3928 CVE-2025-31324 CVE-2025-1976 CVE-2025-42599 CVE-2024-38475 CVE-2023-44221

Red Canary

Critical vulnerability in SAP NetWeaver enables malicious file uploads

Adversaries can exploit CVE-2025-31324 to upload web shells and other unauthorized files to execute on the SAP NetWeaver server April 30, 2025Red Canary has observed activity exploiting a newly-docume ...

Published Date: Apr 30, 2025 (3 weeks, 1 day ago)

CVE-2025-31324

TheCyberThrone

CISA Adds SAP NetWeaver Vulnerability to KEV Catalog

The Cybersecurity and Infrastructure Security Agency (CISA) has added a critical vulnerability affecting SAP NetWeaver to its Known Exploited Vulnerabilities (KEV) Catalog, emphasizing the urgency of ...

Published Date: Apr 30, 2025 (3 weeks, 1 day ago)

CVE-2025-31324

Cyber Security News

CISA Warns SAP 0-day Vulnerability Exploited in the Wild

CISA has added a critical SAP NetWeaver vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on April 29, 2025. The zero-day flaw, tracked as CVE-2025-31324, carries a maximum CVSS score ...

Published Date: Apr 30, 2025 (3 weeks, 2 days ago)

CVE-2025-30194 CVE-2025-31324

Dark Reading

Many Fuel Tank Monitoring Systems Vulnerable to Disruption

Source: jittawit21 via ShutterstockInternet-connected automatic tank gauges (ATGs) pose a serious but often overlooked cyber-risk to the thousands of gas stations, fuel depots, and facilities that rel ...

Published Date: Apr 29, 2025 (3 weeks, 2 days ago)

CVE-2025-31324 CVE-2024-45066 CVE-2024-43693

Dark Reading

SAP NetWeaver Visual Composer Flaw Under Active Exploitation

Source: SuPatMaN via ShutterstockAttackers are actively exploiting a recently patched zero-day vulnerability in SAP's NetWeaver Visual Composer Web-based software modeling tool.CVE-2025-31324 is a cri ...