Attackers Actively Scan for SAP NetWeaver Webshells Exploiting CVE-2025-31324
Threat actors are exploiting a critical SAP NetWeaver vulnerability to upload webshells and are now actively scanning for these compromised systems.
Security researchers have observed a surge in malicious activity targeting SAP NetWeaver systems, with attackers actively scanning for and exploiting a critical vulnerability, CVE-2025-31324, to upload webshells. This vulnerability, which carries a perfect CVSS score of 10, allows for unauthenticated file uploads, making it a prime target for threat actors seeking to establish persistent access.
The primary goal of this campaign appears to be the deployment of webshells, which are then often located in the /irj/servlet_jsp/irj/root/ directory of compromised SAP NetWeaver installations. These webshells provide attackers with a backdoor into the system, enabling them to execute arbitrary commands, exfiltrate data, or further compromise the network.
Recent observations from honeypot data reveal attackers are not only uploading webshells but also actively scanning for systems that may already host them. This scanning activity involves probing various URL paths, some of which are legitimate SAP NetWeaver components, while others appear to be attempts to find existing webshells through common or even misspelled file names, such as ant.jsp, upload.aspx, and even upload.apsx.
One specific threat actor, identified by the IP address 82.26.72.21, has been observed attempting to access a wide array of URLs. While not all of these URLs are directly related to SAP NetWeaver, the pattern suggests a broad scanning effort to identify vulnerable systems or already compromised endpoints.
The vulnerability CVE-2025-31324, though not new, remains a significant threat due to its ease of exploitation and high impact. Its ability to allow unauthenticated file uploads means that even systems with robust authentication mechanisms can be compromised if this specific flaw is present.
Organizations running SAP NetWeaver are strongly advised to ensure their systems are patched against CVE-2025-31324. Furthermore, security teams should implement enhanced monitoring for suspicious file uploads and unusual directory structures within their SAP environments. Regular security audits and vulnerability assessments are crucial to detect and mitigate such threats before they can lead to a full-scale compromise.
The ongoing exploitation of this vulnerability highlights the persistent threat posed by unpatched systems and the critical need for timely security updates. Attackers continue to leverage well-known, high-severity vulnerabilities to gain initial access, underscoring the importance of a proactive security posture.