# Scanners probe for SAP NetWeaver webshells

Published: 2026-11-09 · Severity: elevated · Sectors: Technology
Canonical: https://vorant.io/reports/816c53bc-4c04-58fa-913d-36d29a0561c4/scanners-probe-for-sap-netweaver-webshells
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> Attackers are mass-scanning for SAP NetWeaver webshells and other upload endpoints tied to CVE-2025-31324, a critical unauthenticated file-upload flaw.

Source: isc.sans.edu — https://isc.sans.edu/diary/rss/33502

## What to check

- Applies to: The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: CISA lists CVE-2025-31324 as exploited in the wild.

SANS ISC observed honeypot traffic requesting /irj/servlet_jsp/irj/root/ant.jsp, a path consistent with webshells dropped via CVE-2025-31324, a maximum-severity (CVSS 10) SAP NetWeaver vulnerability allowing unauthenticated file upload. Attackers have been exploiting this flaw to place webshells in the /irj/servlet_jsp/irj/root/ directory, and the observed scanning activity appears aimed at both exploiting the vulnerability and locating already-installed webshells left by prior compromises.

One attacker IP, 82.26.72.21, was seen probing a broad list of URL paths beyond SAP NetWeaver, including SharePoint ToolPane endpoints, Joomla upload components, MagicInfo, NmConsole/WUG, and generic upload.aspx/upload endpoints (including a misspelled 'upload.apsx'), suggesting opportunistic scanning across multiple vulnerable platforms and previously deployed webshells rather than a single targeted campaign.

Defenders running SAP NetWeaver should verify patch status for CVE-2025-31324, check for unexpected files under /irj/servlet_jsp/irj/root/ (especially ant.jsp or similarly named files), and monitor web logs for requests to the listed paths as indicators of scanning or webshell-hunting activity.

## Mentioned in this report

- Vulnerabilities: CVE-2025-31324 (KEV)
- Malware: ant.jsp webshell

## Detection guidance (public sample)

### SAP NetWeaver Visual Composer Webshell Path Request (irj/servlet_jsp/irj/root JSP)

ATT&CK: T1505.003

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs webserver logs. Status: experimental. Generated from the report; not run against telemetry.

Web request for a .jsp file under /irj/servlet_jsp/irj/root/, the directory used for webshells dropped via CVE-2025-31324 (e.g. ant.jsp). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: SAP NetWeaver Visual Composer Webshell Path Request (irj/servlet_jsp/irj/root
  JSP)
description: Detects web requests for JSP files under /irj/servlet_jsp/irj/root/,
  the directory where webshells are placed after exploitation of CVE-2025-31324. Matches
  both scanners hunting for existing webshells (such as ant.jsp) and operators using
  them. Generalises on directory plus .jsp extension, not a single filename.
tags:
- attack.persistence
- attack.t1505.003
- attack.reconnaissance
- attack.t1595.002
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|contains: /irj/servlet_jsp/irj/root/
    cs-uri-stem|endswith: .jsp
  condition: selection
falsepositives:
- Authorised vulnerability scans of SAP NetWeaver hosts by internal security teams
level: high
id: 2572f822-42f4-5561-b478-bea829dfc382
status: experimental
author: Vorant
references:
- https://isc.sans.edu/diary/rss/33502
```

### SAP NetWeaver Unauthenticated Metadata Uploader POST (CVE-2025-31324 Exploitation)

ATT&CK: T1190

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs webserver logs. Status: experimental. Generated from the report; not run against telemetry.

POST to the SAP NetWeaver Visual Composer metadatauploader endpoint, used for the unauthenticated file upload in CVE-2025-31324. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: SAP NetWeaver Unauthenticated Metadata Uploader POST (CVE-2025-31324 Exploitation)
description: Detects HTTP POST requests to the SAP NetWeaver Visual Composer /developmentserver/metadatauploader
  endpoint, the publicly documented vector for the CVE-2025-31324 unauthenticated
  file upload that leads to JSP webshell placement. The endpoint comes from public
  advisories on the CVE, not from the scanning report itself.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: webserver
detection:
  selection:
    cs-method: POST
    cs-uri-stem|contains: /developmentserver/metadatauploader
  condition: selection
falsepositives:
- Legitimate SAP developers using Visual Composer metadata upload on a development
  system that should not be internet-facing
level: high
id: b25eeeea-8ce8-5348-93ef-edd16c825f1a
status: experimental
author: Vorant
references:
- https://isc.sans.edu/diary/rss/33502
```

### Opportunistic Webshell Hunting - Misspelled upload.apsx or SharePoint ToolPane Probe

ATT&CK: T1595.002

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs webserver logs. Status: experimental. Generated from the report; not run against telemetry.

Web requests for upload.apsx (misspelled) or ToolPane.aspx typical of multi-platform scanners hunting for vulnerable apps and previously planted webshells. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Opportunistic Webshell Hunting - Misspelled upload.apsx or SharePoint ToolPane
  Probe
description: Detects requests for the misspelled upload.apsx path or SharePoint ToolPane.aspx,
  seen in opportunistic scanning that probes many platforms (SharePoint, Joomla, MagicInfo,
  WUG) for vulnerabilities and leftover webshells alongside SAP NetWeaver probing.
  Review in context of source IP and the volume of distinct probed paths.
tags:
- attack.reconnaissance
- attack.t1595.002
- attack.persistence
- attack.t1505.003
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|endswith:
    - /upload.apsx
    - /ToolPane.aspx
  condition: selection
falsepositives:
- SharePoint administrators editing web part pages that legitimately load ToolPane.aspx
- Authorised internal vulnerability scanning
level: medium
id: 558ceca0-5321-5ca3-a657-c0a77ff5d146
status: experimental
author: Vorant
references:
- https://isc.sans.edu/diary/rss/33502
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

1 more detection for this report is in the app: an indicator rule with Sigma, Splunk SPL, Elastic, and Suricata. A free account opens it.

Source reporting: https://isc.sans.edu/diary/rss/33502

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/816c53bc-4c04-58fa-913d-36d29a0561c4/scanners-probe-for-sap-netweaver-webshells.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the CVEs and malware it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup