CVE-2025-31324 and Us

on

Up Front

Before diving straight into the technical breakdown, I want to call out a few elements that made this zero-day discovery so fascinating:

  • The flaw sat in the "Visual Composer Development Server," a legacy component that SAP had deprecated back around 2014–2015 (yes, really). Even though it had been functionally obsolete for roughly a decade, the component was still enabled by default or left running dormant across thousands of global production systems.

  • Post-exploitation telemetry revealed that once the zero-day started making rounds, target systems turned into a free-for-all. We saw attackers executing commands specifically to find and rename other attackers' web shells (e.g., swapping helper.jsp to usage.jsp). Attackers were essentially trying to "lock the door behind them" and boot rival hackers off the same compromised NetWeaver server. It was like those king of the hill games on CTF sites.

  • The spectrum of who used this flaw was bizarrely broad. On one end, advanced ransomware affiliates used it to drop Brute Ratel (a sophisticated, expensive Red Team command-and-control framework used for stealthy lateral movement.) On the other end, opportunistic threat actors used the exact same CVSS 10.0 initial access vector just to pull down basic bash scripts and install XMRig cryptocurrency miners.  

In August my team and I were researching some incidents we were seeing across multiple environments. We had put these incidents together in a pot because they shared some interesting patterns. From a threat research perspective, it's this very pattern that sets off our "spidey senses." 👀

The Anomaly

  • Location: RQ, the basement (not really)
  • Lunch: Not eaten yet.
  • Coffee: Over-consumed. 

We didn't know it at the time, but we were witnessing CVE-2025-31324, in the wild for the first time ever. We had uncovered what would become a maximum severity zero-day vulnerability in SAP NetWeaver.

SAP NetWeaver is a software stack and app platform which organisations use as a run-time foundation for SAP enterprise utilities like SAP ERP and CRM. It connects non-SAP systems with SAP software and handles data and business intelligence reporting among many other features.

Our investigation began when our detections flagged unusual web shell activity across several client environments running SAP NetWeaver.

Attackers were dropping JavaServer Pages (.jsp) files into a specific directory path: 

j2ee/cluster/apps/sapcom/irj/servlet_jsp/irj/root/

At first glance, the behaviour looked suspiciously like a Remote File Inclusion or an attempt to exploit older, well-known enterprise bugs (such as CVE-2017-9844). However, as we pivoted through the telemetry, something didn't add up. Several targeted environments were fully updated, running the latest SAP service packs, and had all historical security patches applied.

If patched systems were dropping JSP shells, we weren't looking at an old exploit. We were looking at a zero-day. At this time, the threat research umbrella as a whole were firing on all cylinders. It goes without saying, but this was a pretty exciting time!

Breaking Down the Vulnerability 

By reproducing the HTTP traffic captured prior to the shell placement, we were able to isolate our root cause. It was an unrestricted file upload vulnerability due to a missing authorisation check.

The entry point was the metadatauploader endpoint within the SAP NetWeaver Visual Composer Development Server component (this is a tool used to build application interfaces without traditional code and had actually been deprecated by SAP years prior, yet remained active or accessible in many enterprise deployments)

How the Exploit Worked:

  1. Unauthenticated Access: An attacker sent a crafted POST request targeting the developmentserver application alias. Because authorisation checks were missing, no credentials were required.

  2. Arbitrary File Write: Using the metadatauploader, the attacker bypassed file-type restrictions and uploaded executable binaries or JSP scripts directly into publicly reachable Web application paths.

  3. Remote Code Execution (RCE): Once the web shell (e.g., helper.jsp or cache.jsp) was written to disk, the attacker issued simple HTTP requests to execute system-level commands with the privileges of the SAP service user (<sid>adm).

TLDR? Attackers had keys to the castle. This is because they had full command execution.

Disclosure

Seeing the severe risk to global enterprise operations, we immediately engaged with SAP's Product Security Incident Response Team (PSIRT).

On April 24, 2025, SAP issued emergency Security Note 3594142, assigning the vulnerability a CVSS score of 10.0. Because the threat was actively being exploited in the wild prior to disclosure, rapid response was key.

At the same time, the threat research umbrella engineered proactive behavioural detections targeting file-creation events in the servlet_jsp/irj/root/ directory, giving defenders visibility into potential exploitation before patches could be fully rolled out across complex enterprise IT pipelines.

Awakening

Following public disclosure, the vulnerability became an immediate magnet for threat groups. Tracking post-exploitation datarevealed a chaotic landscape of actors racing to weaponise the flaw:

  • We observed infrastructure tied to groups like BianLian establishing reverse proxies on compromised SAP nodes.

  • Another campaign involved the deployment of PipeMagic (a modular backdoor linked to RansomEXX) via MSBuild abuse, followed by attempts to drop post-exploitation frameworks like Brute Ratel.

  • In subsequent months, threat actor tradecraft evolved. Exploit kits surfaced (including leaks within underground forums like Scattered Lapsus$ Hunters) showing attackers pairing CVE-2025-31324 with CVE-2025-42999 (a Java deserialization flaw in SAP NetWeaver).

By chaining the initial access flaw with deserialisation, attackers transitioned from writing noisy web shells on disk to executing payloads directly in-memory with full SAP administrator (adm) privileges, significantly dampening traditional endpoint detection capabilities.

Aftermath

The story of CVE-2025-31324 highlighted several harsh realities of modern enterprise defence:

  1. Visual Composer was deprecated long before this exploit hit. Legacy subcomponents left enabled in default configurations are often the first place threat actors look.

  2. Threat actors know that enterprise resource planning servers contain sensitive data and critical business logic, making them prime targets for extortion and espionage.

  3. Attackers continuously change file names and payload delivery methods (from raw JSP shells to in-memory deserialisation). This means defenders must monitor for structural anomalies. Think process spawning from web server paths or unauthorised file writes to application roots.


    From catching subtle JSP shell drops to watching threat actors turn victim servers into active war zones, researching CVE-2025-31324 offered a front-row seat to modern threat dynamics. I can't wait to see the likes of it again!