New Critical SAP NetWeaver Flaw Exploited to Drop Web Shell, Brute Ratel Framework

Threat actors are likely exploiting a new vulnerability in SAP NetWeaver to upload JSP web shells with the goal of facilitating unauthorized file uploads and code execution.

"The exploitation is likely tied to either a previously disclosed vulnerability like CVE-2017-9844 or an unreported remote file inclusion (RFI) issue," ReliaQuest said in a report published this week.

The cybersecurity company said the possibility of a zero-day stems from the fact that several of the impacted systems were already running the latest patches.

The flaw is assessed to be rooted in the "/developmentserver/metadatauploader" endpoint in the NetWeaver environment, enabling unknown threat actors to upload malicious JSP-based web shells in the "servlet_jsp/irj/root/" path for persistent remote access and deliver additional payloads.

Put differently, the lightweight JSP web shell is configured to upload unauthorized files, enable entrenched control over the infected hosts, execute remote code, and siphon sensitive data.

Select incidents have been observed using the Brute Ratel C4 post-exploitation framework, as well as a well-known technique called Heaven's Gate to bypass endpoint protections.

At least in one case, the threat actors took several days to progress from successful initial access to follow-on exploitation, raising the possibility that the attacker may be an initial access broker (IAB) that's obtaining and selling access to other threat groups on underground forums.

"Our investigation revealed a troubling pattern, suggesting that adversaries are leveraging a known exploit and pairing it with a mix of evolving techniques to maximize their impact," ReliaQuest said.

"SAP solutions are often used by government agencies and enterprises, making them high-value targets for attackers. As SAP solutions are often deployed on-premises, security measures for these systems are left to users; updates and patches that are not applied promptly are likely to expose these systems to greater risk of compromise."

Coincidentally, SAP has also released an update to address a maximum severity security flaw (CVE-2025-31324, CVSS score: 10.0) that an attacker could exploit to upload arbitrary files.

"SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing an unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system," an advisory for the vulnerability reads.

It's likely that CVE-2025-31324 refers to the same unreported security defect given that the former also affects the metadata uploader component.

The disclosure comes a little over a month after the U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned of active exploitation of another high-severity NetWeaver flaw (CVE-2017-12637) that could allow an attacker to obtain sensitive SAP configuration files.

Update

ReliaQuest has confirmed to The Hacker News that the malicious activity detailed above is indeed leveraging a new security vulnerability that's now being tracked as CVE-2025-31324.

"This vulnerability, which we identified during our investigation published on April 22, 2025, was initially suspected to be a remote file inclusion (RFI) issue," the company said. "However, SAP later confirmed it as an unrestricted file upload vulnerability, allowing attackers to upload malicious files directly to the system without authorization."

In a separate report, SAP security firm Onapsis said the vulnerability is exploitable through HTTP/HTTPS, allowing attackers to send carefully crafted POST requests targeting the "/developmentserver/metadatauploader" endpoint without requiring any authentication.

"Exploitation happens via a POST request to the vulnerable component," Onapsis CTO JP Perez-Etchegoyen said. "Upon successful exploitation, threat actors are able to upload arbitrary files. Threat actors have been observed uploading web shells to vulnerable systems."

The web shells grant the threat actor the ability to execute arbitrary commands in system context, with the privileges of the <sid>adm Operating System user, giving them full access to all SAP resources. The attacks have not been attributed to a specific threat group.

"With <sid>adm access, the attacker gains unauthorized access to the underlying SAP Operating System using the user and privileges of the processes running in the SAP Application Server, implying full access to any SAP resource, including the SAP system database without any restrictions, permitting them to take several actions," the company added.

Users are advised to check for the presence of the following indicators of compromise (IoCs) to determine if they have been affected -

• C:\usr\sap\<SID>\<InstanceID>\j2ee\cluster\apps\sap.com\irj\servlet_jsp\irj\root
• C:\usr\sap\<SID>\<InstanceID>\j2ee\cluster\apps\sap.com\irj\servlet_jsp\irj\work
• C:\usr\sap\<SID>\<InstanceID>\j2ee\cluster\apps\sap.com\irj\servlet_jsp\irj\work\sync

ProjectDiscovery has also released two nuclei templates to detect CVE-2025-31324 so as to verify if users are vulnerable or not and also determine if their instances are compromised by the JSP web shell backdoor used by threat actors.

Exploitation Dates Back to Late March

Rapid7 said in a new analysis that it observed exploitation in multiple customer environments dating back to at least March 27, 2025. Almost all of the attacks targeted manufacturing companies to drop web shells in the "j2ee/cluster/apps/sap.com/irj/servlet_jsp/irj/root/" directory.

According to the Shadowserver Foundation, there are 427 exposed servers as of April 27. Most of the vulnerable systems are in the United States (132), followed by India (45), Australia (38), China (26), Germany (29), Brazil (12), the Netherlands (11), and France (10).

Data gathered by Censys shows that there are approximately 7,562 SAP NetWeaver servers exposed to the internet, primarily concentrated in the United States, India, and China. However, it bears noting not all of these publicly accessible instances are necessarily vulnerable to the flaw as it requires the metadata uploader component to be enabled.

Onapsis has also published an open-source scanner to identify SAP NetWeaver Java systems potentially vulnerable to CVE-2025-31324 and detect the presence of specific IoC artifacts.

Onapsis Releases New Scanner Tool

Onapsis has released a new open-source scanner in collaboration with Google Mandiant to help organizations identify IoCs associated with active exploitation of the flaw in the wild.

This is different from "Onapsis_CVE-2025-31324_Scanner_Tools," which was previously published by the company as a way to detect vulnerable systems in a remote and unauthenticated way, as well as detecting well-known shells. The new assessment utility is primarily aimed at assisting incident responders identifying IoCs related to the exploitation of CVE-2025-31324.

"Over the past couple of days, we detected a significant number of opportunistic actors trying to leverage the existing web shells to compromise the affected systems, to perform a number of actions, including mining cryptocurrency," Perez-Etchegoyen told The Hacker News.

(The story was updated after publication to confirm the exploitation of a new zero-day flaw and include additional details of the malicious activity.)

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.