SAP NetWeaver RCE (CVE-2025-31324): unauthenticated upload to code execution

What happened

On 24 April 2025, SAP disclosed CVE-2025-31324, a missing-authorization vulnerability in NetWeaver Visual Composer's Metadata Uploader. An unauthenticated attacker could upload malicious executable binaries to the server — no login required.

ReliaQuest's follow-up research showed the upload endpoint (/developmentserver/metadatauploader) accepted files without any session check, and the uploaded JSP webshells executed in the server context. CISA added it to the KEV catalog, and within days threat actors were mass-exploiting exposed NetWeaver instances, including deploying the Brute Ratel and Supershell frameworks.

Impact

Full server compromise of the SAP application tier: the webshell runs as the SAP service account, which typically reaches the database, connected ERP documents, and outbound interfaces to warehouse and finance systems. For affected organizations this was not a theoretical RCE — it was an active intrusion wave with ransomware follow-ons reported in several incidents.

Root cause in one paragraph

A development-support upload servlet was reachable over the network with no authorization check at all; the application trusted that only administrators would know the URL, and once the file landed in a web-executable path, the server happily served the attacker's code as its own.

What to do now

• Apply SAP Security Note 3594142 (April 2025) and its follow-ups immediately — this one cannot wait for the monthly window.
• Restrict /developmentserver/* at the reverse proxy to admin networks; it should never face the internet.
• Hunt for unknown .jsp files under the NetWeaver deploy directories and review access logs for metadatauploader hits.
• Rotate SAP service credentials and database passwords if the host was ever exposed unpatched.
• Treat any NetWeaver host exposed in April 2025 as potentially compromised until forensic review says otherwise.

What this means for Magento stores

Magento merchants running SAP as their ERP (stock sync, order push, B2B pricing) felt this second-hand: a compromised NetWeaver can poison the catalog feed or siphon order data through the integration user. The lesson for your own stack is identical — every file-upload endpoint in custom modules must enforce authorization before accepting bytes, not after, and uploaded files must land outside the web root.

Sources

• NVD: CVE-2025-31324
• SAP Security Note 3594142
• ReliaQuest threat research on active exploitation, April–May 2025

Next in this series: Ivanti EPMM RCE (CVE-2025-4428) — /blog/cve-2025-ivanti-epmm-4428