Aperçu
SAP NetWeaver Visual Composer contains a critical authorization vulnerability in its Metadata Uploader component. The vulnerability allows unauthenticated attackers to upload malicious binaries due to missing access controls. This is a pre-authentication remote code execution risk affecting SAP NetWeaver installations. La vulnérabilité a été divulguée le April 24, 2025. CISA a identifié CVE-2025-31324 comme étant exploitée et est connue pour être utilisée dans des campagnes de rançongiciel.
Détails techniques
SAP NetWeaver Visual Composer's Metadata Uploader component fails to implement proper authorization controls on file upload functionality. This allows unauthenticated remote attackers to upload arbitrary binary files to the system without any authentication or authorization checks. The vulnerability could be exploited to upload malicious executables or libraries that could lead to remote code execution with the privileges of the NetWeaver application.
La vulnérabilité est classifiée comme CWE-276 (Incorrect Default Permissions) , CWE-434 (Unrestricted Upload of File with Dangerous Type) etCWE-862 (Missing Authorization) .
La vulnérabilité a reçu un score de base CVSS v3.1 de 9.8 (CRITICAL) avec la chaîne vectorielle CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indiquant sa nature critical.
Impact
An unauthenticated attacker can upload malicious binary files to the SAP NetWeaver system. This can lead to remote code execution, complete system compromise, unauthorized access to sensitive data, modification or deletion of critical data, and disruption of SAP services. The vulnerability is particularly critical because it requires no authentication and can be exploited remotely with low complexity.
Mitigation et contournements
Comme contournements temporaires : implement network-level access controls to restrict access to the metadata uploader endpoint. use web application firewall (waf) rules to block unauthorized upload requests.; disable the visual composer metadata uploader functionality if not in use, or restrict it to internal networks only.; implement authentication/authorization at the reverse proxy or api gateway level as an additional security layer pending official patches., et monitor file upload activity in the metadata uploader for suspicious binaries or executable files..
Recommandation de CISA : Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Source : Ce rapport a été généré par IA
