SAP NetWeaver Vulnerability

SAP NetWeaver Vulnerability

On April 24, 2025, SAP disclosed a critical vulnerability, CVE-2025-31324, with a CVSS score of 10.0, affecting SAP NetWeaver's Visual Composer Framework, version 7.50.

This vulnerability allows unauthenticated users to upload arbitrary files to the SAP NetWeaver application server, leading to potential remote code execution (RCE) and complete system takeover. The exploit is accomplished by sending specially crafted HTTP requests to the /developmentserver/metadatauploader endpoint.

Affected Systems

All versions 7.1x+ and all SPSs with the Visual Composer component enabled.

IoC’s

-

Recommended Solution(s)

• SAP released an urgent patch for this vulnerability on April 24, 2025 (SAP Security Note 3594142)
• On May 13, 2025, a supplemental security note (SAP Security Note 3604119) was released for CVE-2025-42999. This fixes the root cause of CVE-2025-31324.
• If you cannot apply the updates immediately, you can completely remove sap.com/devserver_metadataupload_ear by applying the "Option 0" option specified in SAP Note 3593336.

CVE / CWE

CVE-2024-49112

Related Website(s)

• https://nvd.nist.gov/vuln/detail/CVE-2024-49112
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49112

* Vulnerabilities with a CVSS 3.1 score between 7.0 and 8.9 are evaluated to be “high” whereas vulnerabilities with a CVSS 3.1 score between 9.0 and 10.0 are evaluated to be “critical”.