威脅情資

CVE-2025-31324: SAP NetWeaver 漏洞

2025.07.08Cyber Threat Intelligence

本文改寫自 TeamT5〈 2025 年 5 月第二期的漏洞情資報告（VIR 2024 April H2）〉。 TeamT5 漏洞研究團隊致力於針對重大漏洞提供即時的應對措施與緩解方案。如欲進一步了解 TeamT5 的漏洞情資報告，請與我們聯繫。

CVE-2025-31324: SAP NetWeaver
TeamT5 偵測到 SAP NetWeaver 中一個高風險漏洞 (CVE-2025-31324) 已被與中國有關聯的 APT 組織 Amoeba（又稱 APT41）積極利用。 Amoeba 的早期利用可追溯到 2025 年 5 月，而公開報告顯示，其零日漏洞利用最早出現在 2025 年 1 月。成功利用漏洞後，攻擊者部署 webshell 和惡意軟體（例如 vshell 和 CobaltStrike Beacon）。
此外，我們進一步調查發現，多家主流雲端服務供應商也受到影響，包括 Google Cloud、Microsoft Azure、Amazon Web Service 在內，超過 100 家組織遭到 webshell 攻擊。受害者遍佈台灣、韓國、中國、印度、美國、西班牙、土耳其、俄羅斯、德國、瓜地馬拉、聖巴瑟米和智利，涉及教育、製造、汽車、回收、旅遊、IT、食品飲料和商業集團等產業。
本文詳細說明攻擊手法與情況。

The following blog post is based on our May H1 Vulnerability Insights Report. TeamT5 Vulnerability Research Team is dedicated to providing timely mitigation and response guidelines to critical vulnerabilities. Contact us for more information about our vulnerability intelligence.

Active Exploitation of CVE-2025-31324 in SAP NetWeaver

TeamT5 has detected that a critical vulnerability (CVE-2025-31324) in SAP NetWeaver was actively exploited by China-nexus APT group, Amoeba (aka APT41). The earliest exploitation of Amoeba can be traced back to May 2025, whereas public reports suggested that the zero-day exploitation has observed in January 2025. The threat actors deployed webshell and malware, such as vshell and CobaltStrike Beacon, after successful exploitation.

Moreover, our further investigation found that several major cloud services providers were affected. Over 100 entities, including Google Cloud, Microsoft Azure, Amazon Web Service, were compromised with webshell. The victims are in Taiwan, South Korea, China, India, the United States, Spain, Turkey, Russia, Germany, Guatemala, Saint Barthélemy, and Chile, spanning education, manufacturing, automotive, recycling, tourism, IT, food and beverage, and conglomerate.

We conclude the attacks in Exploitation Status below.

Executive Summary

We assess the severity level of CVE-2025-31324 as critical and urge our customers to use this report to mitigate the effects. CVE-2025-31324 is an unauthenticated file upload vulnerability in SAP NetWeaver Visual Composer Metadata Uploader. With a CVSS score of 9.8, successful exploitation of CVE-2025-31324 allows unauthenticated threat actor to upload webshell and implant malware.

SAP fixed the vulnerability in a security note released in May 2025 [1]. Yet, Public reports and Proof-of-Concepts of CVE-2025-31324 was published since April 2025 [2][3]. Public reports suggested that CVE-2025-31324 has been exploited as zero-day vulnerability in the wild since January 2025[4].

Based on our investigation and the current exploitation status of CVE-2025-31324, we depicted the Forensic Artifacts in this report. We also concluded the malware and IoC in Appendix I: Malware Table and Appendix II: Indicators of Compromise (IoC). Most importantly, we prepare a comprehensive Mitigation and Response Advisory for our customers.

The Mitigation and Response Advisory includes:

Official Information
Threat Hunting Tools: We provide a YARA rule to detect generic JSP webshell.

Exploitation Status

CVE-2025-31324 has been exploited by China-nexus APT group Amoeba since May 2025.

Amoeba exploited CVE-2025-31324 in attacks against India, Germany, Turkey, Spain, spinning recycling, automotive, and tourism industry.
- In the attacks, Amoeba deployed webshell as initial payload and implanted malware such as CobaltStrike Beacon and vshell.
- The C2 of the malware are 43.133.196.194 and 101.32.26.154.
In addition to the APT activities, our further investigation found that several major cloud services providers were affected. Over 100 entities, including Google Cloud, Microsoft Azure, Amazon Web Service, were compromised with webshell.

Affected Products

Product – SAP NetWeaver (Visual Composer development server) Version – VCFRAMEWORK 7.50

Mitigation and Response Advisory

1. Official Information

Successful exploitation of CVE-2025-31324 allows unauthenticated threat actors to upload webshell and implant malware. We highly recommend our client to patch the vulnerability immediately.

SAP fixed CVE-2025-31324 in a security note released in May 2025:

https://support.sap.com/en/my-support/knowledge-base/security-notes-news/may-2025.html

2. Threat Hunting Tools

CVE-2025-31324 allows unauthenticated threat actors to upload webshell. TeamT5 vulnerability team prepare a YARA rule for our clients to detect generic JSP webshell.

The YARA rule can be downloaded from Threat Hunting Tools in our solution ThreatVision.

Forensic Artifacts

Our investigation found that the exploitation of CVE-2025-31324 will leave following traces. Our clients can use the following Forensic Artifacts for investigation.

1. Webshells

Unauthorized threat actors can exploit CVE-2025-31324 to upload webshell to ./apps/sap.com/irj/root/ and ./apps/sap.com/irj/work/. Common webshells include cache.jsp, shell.jsp, helper.jsp, usage.jsp, user.jsp, readme.jsp.

We provide the YARA rule for our customers to detect webshell.

2. Check SAP Access Log for Suspicious Activities

Exploiting CVE-2025-31324 and access webshells will generate specific content to access log. Our clients can check the access log to identify potential suspicious activities and the attacker's IPs.

The access log can be found in SAP installation path:./log/system/httpaccess/responses*.trc*.
Exploiting CVE-2025-31324 will generate ATTACKER_IP : POST /developmentserver/metadatauploader?CONTENTTYPE=MODEL&CLIENT=1 HTTP/1.1 200 in access log.
Accessing webshell will generate ATTACKER_IP : GET /irj/helper.jsp?cmd=COMMAND HTTP/1.1 200 in access log.

Appendix I: Malware Table

Malware Table introduces the malware mentioned in this report.

Name	Type	Description	Attribution	First Seen
vshell	RAT	vshell is an open-source RAT that offers tunnel proxies and covert channels to emulate persistent attack behaviors within networks. With support for multiple protocols, robust compatibility, and extensive collaboration features, it enables blue teams to enhance security equipment assessment and bolster emergency response capabilities. vshell is widely used in red-blue attack and defense drills and confrontation simulations, simulating the strategies and techniques of APT threat actors.	Open-source	2023.09
CobaltStrike Beacon	RAT	CobaltStrike Beacon is the payload of Cobalt Strike, a commercial penetration testing software used by various red teams, ethical hackers, and threat actors. It is highly customizable with features such as key logging, file transfer, SOCKS proxying, privilege escalation, and mimikatz. CobaltStrike is a legitimate tool used by ethical hackers, but it is also a cyber weapon employed by threat actors to launch real attacks against companies and organizations.	Shared	2016.05

Appendix II: Indicators of Compromise (IoC)

101.32.26.154
43.133.196.194

7ec3d703d7fa41d0f13100ea352a9afd22c0e32f3fd1b2e08a83163ddcbe56d5
d560a377ffdba0efe9905d2d84492b486b115f60ee9a9efea850f67106ca9f14
3f5fd4b23126cb21d1007b479954af619a16b0963a51f45cc32a8611e8e845b5
c7b9ae61046eed01651a72afe7a31de088056f1c1430b368b1acda0b58299e28
9fb57a4c6576a98003de6bf441e4306f72c83f783630286758f5b468abaa105d