Skip to content
NewA calmer, faster ZeroHour
Exploit / PoChighExploited in the wild

Honeypot sees scans for SAP NetWeaver webshells via CVE-2025-31324

Original title: Attackers Searching for SAP Netweaver Webshells, (Mon, Nov 9th)

SANS Internet Storm Center ()1 min read1
Read at isc.sans.edu
Part of a story covered by 4 sourcesSAP patches four unauthenticated CVSS 10 flawsMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

SANS logged requests for ant.jsp and other upload paths, including an unauthenticated upload bug scored CVSS 10.

SANS Internet Storm Center saw honeypot requests for /irj/servlet_jsp/irj/root/ant.jsp and many other upload URLs. The diary ties the activity to CVE-2025-31324, an old SAP NetWeaver flaw that lets unauthenticated attackers upload files and has been used to plant webshells, often under that path. One source, 82.26.72.21, requested SAP and non-SAP paths, including a misspelled upload.apsx.

Unconfirmed: The diary presents honeypot hits from one address, not confirmed compromise of a named victim.

Key facts
  • CVE-2025-31324 is described as CVSS 10 with unauthenticated file upload.
  • Webshells are usually placed in /irj/servlet_jsp/irj/root/.
  • Observed names include ant.jsp, ant.php, ant.aspx and upload.apsx.
  • The listed requests came from 82.26.72.21.
Security assessment · AI, from the articleExploited in the wild

Impact: Unauthenticated file upload used to plant webshells

ProductAffected
SAP NetWeaver—
What to do
  1. 1.Search SAP NetWeaver for webshells under /irj/servlet_jsp/irj/root/, including ant.jsp.
  2. 2.Review exposure to CVE-2025-31324 and remove any uploaded webshells.
Analyze CVE-2025-31324 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2025-31324
ATT&CK
T1190 Exploit Public-Facing ApplicationT1505.003 Web Shell
Tags
sapnetweaverwebshellhoneypot
Vendors
SAP
Products
SAP NetWeaver
Organizations
SANS Internet Storm Center

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2025-31324
Unauthenticated File Upload RCE in SAP NetWeaver Visual Composer
9.899%KEVRansomwarePoC
KEV

Indicators of compromise

auto-extracted · verify before use · export allAll
TypeIndicatorContext
ipv482.26.72.21up in /irj/servlet_jsp/irj/root/. One particular attacker, 82.26.72.21, is hitting the following URLs. Not all of these URLs are S

From the original article

1 min read at isc.sans.edu

This request is part of a larger campaign to exploit SAP NetWeaver or to find already installed webshells. The exploited vulnerability is "old": CVE-2025-31324. A perfect 10 CVSS score and the simple ability to upload files without authentication.

SANS Internet Storm Center

isc.sans.edu

Read the full article at SANS Internet Storm Center

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.