SAP NetWeaver Visual Composer CVE-2025-31324 (CVSS 10, metadatauploader unauthenticated file upload, exploited): how do I check for webshells and patch?

What it is: CVE-2025-31324 is a missing authorization check in the Metadata Uploader of SAP NetWeaver Visual Composer (Java stack). It lets an unauthenticated attacker upload executable files to the server. It was exploited as a zero-day in April 2025 to plant JSP webshells, used by several criminal and state-linked groups afterwards, and is in CISA's Known Exploited Vulnerabilities catalog. A related deserialization flaw in the same component, CVE-2025-42999, was fixed in May 2025. Am I affected: - SAP NetWeaver Application Server Java with Visual Composer (VCFRAMEWORK 7.50) installed, which is common even where nobody uses it, without SAP Note 3594142 (and 3604119 for CVE-2025-42999). - Check in your SAP system whether the Visual Composer development server component is deployed, and whether the /developmentserver/metadatauploader path answers from the network. Fix: 1. Apply SAP Security Notes 3594142 and 3604119 (or a later support package that includes them). 2. If you can't patch immediately: follow the workaround in SAP's note (KBA 3593336) to block or remove access to the developmentserver application, and disable Visual Composer entirely if you don't use it. Don't expose the NetWeaver Java portal to the internet. After (do this even if you've patched, since exploitation began before the fix): - Look for .jsp, .java or .class files that shouldn't be there under the servlet_jsp irj root and work directories of the Java instance (for example ...\j2ee\cluster\apps\sap.com\irj\servlet_jsp\irj\root\ and its work and work\sync folders). Unknown files there should be treated as webshells. - Review HTTP logs for POST requests to the metadatauploader path and for requests to unfamiliar JSP files. - If you find anything, treat the system as compromised: isolate it, involve SAP incident response, rotate SAP and OS credentials, and check connected systems. Sources: https://www.helpnetsecurity.com/2025/04/28/sap-netweaver-cve-2025-31324-exploited/ https://threatprotect.qualys.com/2025/04/28/sap-netweaver-zero-day-remote-code-execution-vulnerability-cve-2025-31324/ https://horizon3.ai/attack-research/vulnerabilities/cve-2025-31324/