CVE-2025-31324
SAP NetWeaver Unrestricted File Upload Vulnerability
Description
CVE-2025-31324 is a maximum-severity unrestricted file upload vulnerability in SAP NetWeaver Visual Composer's Metadata Uploader component. The flaw allows an unauthenticated remote attacker to upload potentially malicious executable binaries to the server, leading to complete system compromise. With the highest possible CVSS v3.1 score of 10.0 and a CRITICAL severity rating, this vulnerability represents the most dangerous class of security defect. CISA has added CVE-2025-31324 to the Known Exploited Vulnerabilities catalog, and it is known to be used in ransomware campaigns. The EPSS score of 38.44% at the 97.15th percentile confirms widespread active exploitation targeting SAP NetWeaver environments.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| sap | netweaver | 7.50 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://me.sap.com/notes/3594142(Permissions Required)
- https://url.sap/sapsecuritypatchday(Vendor Advisory)
- https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/(Third Party Advisory)
- https://www.bleepingcomputer.com/news/security/sap-fixes-suspected-netweaver-zero-day-exploited-in-attacks/(Press/Media Coverage)
- https://www.theregister.com/2025/04/25/sap_netweaver_patch/(Press/Media Coverage)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31324(US Government Resource)
Weakness Type
CWE-434: Unrestricted Upload of File with Dangerous Type
CVE-2025-31324 is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type), which occurs when a web application allows users to upload files without properly validating the file type, content, or destination. In the SAP NetWeaver Visual Composer Metadata Uploader, the upload endpoint lacks proper authorization controls, allowing unauthenticated users to upload arbitrary files, including executable binaries and web shells. This absence of both authentication and file type validation creates a direct path to remote code execution.
Learn more: CWE-434 — Unrestricted Upload of File with Dangerous Type
Impact Analysis
CVE-2025-31324 achieves the maximum CVSS v3.1 base score of 10.0 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. This vulnerability is remotely exploitable over the network (AV:N) with low attack complexity (AC:L), requires no authentication (PR:N) and no user interaction (UI:N), and the scope is changed (S:C), meaning a successful exploit can affect resources beyond the vulnerable SAP NetWeaver component itself. Confidentiality (High): An attacker can access all data managed by the SAP system, including business-critical information, financial records, employee data, and customer information. Integrity (High): The ability to upload and execute arbitrary code means the attacker can modify any data, install persistent backdoors, and manipulate business processes. Availability (High): The attacker can disrupt SAP services, destroy data, or use the compromised system as a pivot point for further attacks. The confirmed ransomware association makes this vulnerability particularly dangerous, as attackers are known to encrypt SAP systems and demand payment for data recovery. The EPSS score of 38.4% at the 97.1th percentile indicates a very high probability of exploitation, demanding immediate remediation.
Exploit Maturity
CVE-2025-31324 demonstrates very high exploit maturity with confirmed active exploitation in the wild. CISA has added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of May 20, 2025, and critically, it is known to be leveraged in ransomware campaigns. Multiple third-party sources have published detailed analyses of the exploitation activity, including Onapsis which documented active exploitation targeting SAP systems. The EPSS score of 38.4% at the 97.1th percentile indicates a very high probability of exploitation, confirming that a large number of threat actors are actively exploiting this vulnerability. The combination of unauthenticated access, trivial exploitation, and the high value of SAP systems as targets for both data theft and ransomware makes CVE-2025-31324 one of the most critical vulnerabilities to remediate immediately.
Remediation
-
Apply SAP security patches immediately. Install the fix documented in SAP Security Note 3594142. Consult the SAP Security Patch Day for the latest available patches for NetWeaver 7.50.
-
Disable or restrict the Visual Composer Metadata Uploader. If the Visual Composer component is not actively used, disable it entirely. If it must remain enabled, restrict network access to the Metadata Uploader endpoint to only authorized internal systems.
-
Conduct immediate forensic investigation. Check the SAP NetWeaver server for indicators of compromise including uploaded web shells, unauthorized executable files, new or modified user accounts, and unusual outbound network connections. Given the ransomware association, check for any signs of data exfiltration or encryption preparation.
-
Implement Web Application Firewall (WAF) rules. Deploy WAF rules to block unauthorized file upload attempts to the Visual Composer Metadata Uploader endpoint. Filter requests by content type and reject executable file uploads from unauthenticated sources.
-
Strengthen network segmentation around SAP systems. Ensure SAP NetWeaver servers are isolated in dedicated network segments with strict ingress and egress controls. Monitor all network traffic to and from SAP systems for anomalous patterns indicative of exploitation or data exfiltration.
Technical Details
CVE-2025-31324 is an unrestricted file upload vulnerability in the SAP NetWeaver Visual Composer Metadata Uploader component. The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H reflects the worst-case scenario: network-accessible, low complexity, no privileges needed, no user interaction, changed scope, and maximum impact across all CIA dimensions.
The vulnerability exists because the Metadata Uploader endpoint in SAP NetWeaver Visual Composer does not enforce proper authorization checks. An unauthenticated attacker can send HTTP requests to the upload endpoint and submit arbitrary files, including compiled Java classes, web shells, or other executable binaries. The uploaded files are stored in locations accessible to the web server, allowing the attacker to subsequently trigger their execution. This effectively provides the attacker with remote code execution capabilities on the SAP NetWeaver server, running with the privileges of the SAP application process. The changed scope (S:C) in the CVSS vector indicates that exploitation can affect the entire SAP landscape beyond just the Visual Composer component, as the SAP process typically has access to databases, file systems, and other connected SAP systems.
Frequently Asked Questions
Is CVE-2025-31324 being actively exploited?
Yes. CISA has confirmed active exploitation and added CVE-2025-31324 to the Known Exploited Vulnerabilities catalog. This vulnerability is also known to be used in ransomware campaigns, making it one of the highest-priority threats facing SAP environments.
What products are affected by CVE-2025-31324?
SAP NetWeaver version 7.50 with the Visual Composer Metadata Uploader component is affected. Organizations running any SAP NetWeaver environment should verify whether the Visual Composer component is installed and exposed.
How do I fix CVE-2025-31324?
Apply SAP Security Note 3594142 immediately. If patching is not immediately possible, disable the Visual Composer Metadata Uploader component or restrict network access to the upload endpoint. Conduct a forensic investigation to determine if the system has already been compromised.
How severe is CVE-2025-31324?
CVE-2025-31324 has the maximum possible CVSS score of 10.0 (CRITICAL). It allows unauthenticated remote code execution with no user interaction, affects the scope beyond the vulnerable component, and is actively used in ransomware campaigns. This is one of the most severe vulnerabilities that can affect an enterprise SAP environment.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.