CVE-2025-31324

CVE-2025-31324: SAP NetWeaver Visual Composer Metadata Uploader Unauthenticated File Upload (CVSS 10)

AI-generated analysis based on the vulnerability data on this page.

Summary

A critical authorization flaw exists in the SAP NetWeaver Visual Composer Metadata Uploader. Because the endpoint does not enforce authentication, remote attackers can upload potentially malicious executable binaries without credentials, leading to full compromise of the host system.

Background

SAP NetWeaver is a widely deployed application platform that serves as the technical foundation for SAP Business Suite and other SAP solutions. The Visual Composer component provides a metadata-driven design environment. The Metadata Uploader functionality within Visual Composer is intended to import metadata artifacts, but in affected releases it is exposed without adequate access controls.

Root Cause

The vulnerability is classified as CWE-434: Unrestricted Upload of File with Dangerous Type. The Metadata Uploader endpoint fails to verify that the requester is authenticated and authorized before accepting file uploads. Consequently, any network-reachable actor can submit files, including executable binaries, to the server. The application also does not appear to adequately validate or restrict uploaded file types, allowing dangerous content to be placed in contexts where it can be processed or executed by the host.

Impact

With a CVSS 3.1 score of 10.0 (Critical), this vulnerability is among the most severe. The vector string AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H indicates that it is:

• Network exploitable with low attack complexity
• No privileges or user interaction required
• Scope changed, meaning the vulnerable component can impact resources beyond its own security scope
• High impact on Confidentiality, Integrity, and Availability

Successful exploitation can result in complete system compromise, data exfiltration, malware deployment, and disruption of business-critical SAP services.

Exploitation Walkthrough

Ethics Notice: This section is intended for defensive awareness and detection engineering only. Do not attempt to exploit systems you do not own or have explicit permission to test.

An attacker who can reach the SAP NetWeaver Visual Composer Metadata Uploader over the network can issue an unauthenticated upload request. Because the endpoint lacks authorization checks, the server accepts the payload and writes it to a location accessible to the application or underlying host. If the uploaded file is an executable or contains executable content, the attacker may then be able to trigger its execution through application logic, scheduled tasks, or direct invocation, depending on server configuration. Defenders should assume that any NetWeaver 7.50 instance with an exposed Visual Composer Metadata Uploader is at high risk of compromise if unpatched.

Affected and Patched Versions

• Affected: SAP NetWeaver 7.50 (cpe:2.3:a:sap:netweaver:7.50:*:*:*:*:*:*:*)
• Patched: SAP has released security updates. Refer to SAP Note 3594142 and the SAP Security Patch Day guidance for specific patch levels and support package information.

Remediation

1. Apply SAP patches immediately. Prioritize systems running NetWeaver 7.50 and follow SAP Note 3594142.
2. Restrict network access. Limit exposure of SAP NetWeaver administration and development interfaces, including Visual Composer endpoints, to trusted administrative hosts or jump boxes.
3. Implement compensating controls. If patching is delayed, consider network-level segmentation, reverse-proxy rules, or Web Application Firewall (WAF) policies to block unauthenticated upload requests to the Metadata Uploader path.
4. Validate file uploads. Ensure that any upload endpoints enforce strict file-type validation, restrict executable content, and store uploads outside web-accessible directories.

Detection

• Monitor HTTP access logs for POST requests to the Visual Composer Metadata Uploader endpoint from unexpected source IPs.
• Alert on uploaded files with executable extensions or MIME types in directories used by Visual Composer.
• Correlate host-level telemetry (process creation, file integrity monitoring) with web upload events to identify potential follow-on execution.
• Hunt for anomalous outbound connections from SAP application servers that may indicate successful compromise.

Assessment

This vulnerability is exceptionally dangerous. An EPSS score of 0.99359 places it in the top tier of observed vulnerabilities by exploitation likelihood, and its inclusion in both the CISA KEV catalog and the EU exploited vulnerabilities database (since 2025-04-29) confirms that it is under active, in-the-wild exploitation. The combination of unauthenticated network access and unrestricted file upload creates a trivial path to remote code execution.

Key lessons:

• Upload endpoints must always require strong authentication and authorization.
• File upload functionality should enforce strict content validation and avoid writing user-supplied data to executable or web-servable paths.

References

• https://me.sap.com/notes/3594142
• https://url.sap/sapsecuritypatchday
• https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/
• https://www.bleepingcomputer.com/news/security/sap-fixes-suspected-netweaver-zero-day-exploited-in-attacks/
• https://www.theregister.com/2025/04/25/sap_netweaver_patch/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31324