Scanners probe for SAP NetWeaver webshells
Attackers are mass-scanning for SAP NetWeaver webshells and other upload endpoints tied to CVE-2025-31324, a critical unauthenticated file-upload flaw.
Sourceisc.sans.edu — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2025-31324 as exploited in the wild.
SANS ISC observed honeypot traffic requesting /irj/servlet_jsp/irj/root/ant.jsp, a path consistent with webshells dropped via CVE-2025-31324, a maximum-severity (CVSS 10) SAP NetWeaver vulnerability allowing unauthenticated file upload. Attackers have been exploiting this flaw to place webshells in the /irj/servlet_jsp/irj/root/ directory, and the observed scanning activity appears aimed at both exploiting the vulnerability and locating already-installed webshells left by prior compromises.
One attacker IP, 82.26.72.21, was seen probing a broad list of URL paths beyond SAP NetWeaver, including SharePoint ToolPane endpoints, Joomla upload components, MagicInfo, NmConsole/WUG, and generic upload.aspx/upload endpoints (including a misspelled 'upload.apsx'), suggesting opportunistic scanning across multiple vulnerable platforms and previously deployed webshells rather than a single targeted campaign.
Defenders running SAP NetWeaver should verify patch status for CVE-2025-31324, check for unexpected files under /irj/servlet_jsp/irj/root/ (especially ant.jsp or similarly named files), and monitor web logs for requests to the listed paths as indicators of scanning or webshell-hunting activity.
Mentioned in this report
Detection guidance
SAP NetWeaver Visual Composer Webshell Path Request (irj/servlet_jsp/irj/root JSP)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Web request for a .jsp file under /irj/servlet_jsp/irj/root/, the directory used for webshells dropped via CVE-2025-31324 (e.g. ant.jsp). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SAP NetWeaver Visual Composer Webshell Path Request (irj/servlet_jsp/irj/root
JSP)
description: Detects web requests for JSP files under /irj/servlet_jsp/irj/root/,
the directory where webshells are placed after exploitation of CVE-2025-31324. Matches
both scanners hunting for existing webshells (such as ant.jsp) and operators using
them. Generalises on directory plus .jsp extension, not a single filename.
tags:
- attack.persistence
- attack.t1505.003
- attack.reconnaissance
- attack.t1595.002
logsource:
category: webserver
detection:
selection:
cs-uri-stem|contains: /irj/servlet_jsp/irj/root/
cs-uri-stem|endswith: .jsp
condition: selection
falsepositives:
- Authorised vulnerability scans of SAP NetWeaver hosts by internal security teams
level: high
id: 2572f822-42f4-5561-b478-bea829dfc382
status: experimental
author: Vorant
references:
- https://isc.sans.edu/diary/rss/33502
SAP NetWeaver Unauthenticated Metadata Uploader POST (CVE-2025-31324 Exploitation)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
POST to the SAP NetWeaver Visual Composer metadatauploader endpoint, used for the unauthenticated file upload in CVE-2025-31324. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SAP NetWeaver Unauthenticated Metadata Uploader POST (CVE-2025-31324 Exploitation)
description: Detects HTTP POST requests to the SAP NetWeaver Visual Composer /developmentserver/metadatauploader
endpoint, the publicly documented vector for the CVE-2025-31324 unauthenticated
file upload that leads to JSP webshell placement. The endpoint comes from public
advisories on the CVE, not from the scanning report itself.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-method: POST
cs-uri-stem|contains: /developmentserver/metadatauploader
condition: selection
falsepositives:
- Legitimate SAP developers using Visual Composer metadata upload on a development
system that should not be internet-facing
level: high
id: b25eeeea-8ce8-5348-93ef-edd16c825f1a
status: experimental
author: Vorant
references:
- https://isc.sans.edu/diary/rss/33502
Opportunistic Webshell Hunting - Misspelled upload.apsx or SharePoint ToolPane Probe
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Web requests for upload.apsx (misspelled) or ToolPane.aspx typical of multi-platform scanners hunting for vulnerable apps and previously planted webshells. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Opportunistic Webshell Hunting - Misspelled upload.apsx or SharePoint ToolPane
Probe
description: Detects requests for the misspelled upload.apsx path or SharePoint ToolPane.aspx,
seen in opportunistic scanning that probes many platforms (SharePoint, Joomla, MagicInfo,
WUG) for vulnerabilities and leftover webshells alongside SAP NetWeaver probing.
Review in context of source IP and the volume of distinct probed paths.
tags:
- attack.reconnaissance
- attack.t1595.002
- attack.persistence
- attack.t1505.003
logsource:
category: webserver
detection:
selection:
cs-uri-stem|endswith:
- /upload.apsx
- /ToolPane.aspx
condition: selection
falsepositives:
- SharePoint administrators editing web part pages that legitimately load ToolPane.aspx
- Authorised internal vulnerability scanning
level: medium
id: 558ceca0-5321-5ca3-a657-c0a77ff5d146
status: experimental
author: Vorant
references:
- https://isc.sans.edu/diary/rss/33502
1 more detection for this report is in the app — an indicator rule with Sigma, Splunk SPL, Elastic, and Suricata. Free account, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://isc.sans.edu/diary/rss/33502
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the CVEs and malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs