News from the AI & ML world
DeeperML - #sap
|
@unit42.paloaltonetworks.com
//
A critical security flaw, CVE-2025-31324, affecting SAP NetWeaver Visual Composer 7.x is under active exploitation in the wild. This deserialization vulnerability allows unauthenticated remote code execution through malicious uploads to the `/developmentserver/metadatauploader` endpoint. Attackers are leveraging this flaw to deploy web shells and gain full control of vulnerable SAP servers. Forescout Vedere Labs researchers have linked ongoing attacks targeting this vulnerability to a Chinese threat actor dubbed Chaya_004. Evidence suggests opportunistic scanning and exploitation attempts against SAP systems have been occurring since late April 2025 across multiple industries.
The Chinese-speaking threat group tracked as Chaya_004 by Forescout has been actively exploiting the SAP NetWeaver vulnerability. The attackers have not only deployed classic web shells but have also installed sophisticated management backdoors like Supershell, a Go-based remote shell favored among Chinese APT operators. Forescout's adversary engagement environments detected mass scanning shortly after the public disclosure of the bug and its inclusion in CISA’s Known Exploited Vulnerabilities (KEV) catalog. The scanning activity primarily originated from Microsoft and Amazon cloud ASNs, indicating both benign research and malicious reconnaissance efforts. Technical analysis of the attacker's infrastructure revealed a network of over 500 IPs, many hosted on leading Chinese cloud providers. This infrastructure contained not just Supershell but also an arsenal of penetration testing and asset discovery tools. The observed toolset includes NPS, SoftEther VPN, Cobalt Strike, ARL, Pocassit, Gosint, and bespoke tunnels written in Go. The use of Chinese cloud providers and Chinese-language tools strongly suggests the campaign is orchestrated by a seasoned Chinese threat actor. Applying the latest security patches is crucial for organizations to protect their SAP NetWeaver systems from potential compromise.
Share:
References :
Classification:
@reliaquest.com
//
A critical zero-day vulnerability, CVE-2025-31324, has been discovered in SAP NetWeaver Visual Composer Metadata Uploader, posing a significant threat to organizations using the platform. The flaw stems from missing authorization checks on the `/developmentserver/metadatauploader` endpoint, allowing unauthenticated attackers to upload malicious files directly to the system. This unrestricted file upload vulnerability has a CVSS score of 10, indicating its critical severity and potential for widespread exploitation. Security researchers and threat hunters have already observed active exploitation in the wild, with threat actors using the vulnerability to drop web shell backdoors onto exposed systems.
Exploitation of CVE-2025-31324 enables attackers to gain unauthorized access and control over SAP systems. Threat actors are leveraging the vulnerability to upload web shells, facilitating remote code execution and further system compromise. These web shells allow attackers to execute commands, manage files, and perform other malicious actions directly from a web browser. According to SAP security platform Onapsis, the vulnerability can afford attackers the opportunity to take full control over SAP business data and processes, potentially leading to ransomware deployment and lateral movement within a network. SAP has released an out-of-band emergency patch to address CVE-2025-31324, and organizations are strongly encouraged to apply the patch as soon as possible to mitigate the risk. ReliaQuest researchers also reported investigating multiple customer incidents involving JSP webshells uploaded via this vulnerability. Given the widespread active exploitation and the potential for significant impact, organizations should prioritize patching vulnerable systems and assessing them for any signs of compromise. Experts estimate that a significant percentage of internet-facing SAP NetWeaver systems may be vulnerable, highlighting the urgency of addressing this critical flaw.
Share:
References :
Classification:
Walter Sun@SAP News Center
//
SAP and NVIDIA are deepening their collaboration to deliver advanced AI capabilities to businesses worldwide. SAP is integrating NVIDIA's Llama Nemotron reasoning models to enhance the reasoning capabilities of its AI agents. This strategic move aims to improve accuracy and equip AI agents with advanced decision-making and execution skills. By incorporating these models, SAP's Joule agents will be better equipped to handle complex business challenges through deeper contextual reasoning and seamless interaction with enterprise data and systems, fostering more intelligent and autonomous operations.
The partnership between SAP and NVIDIA has already yielded AI innovations transforming business operations. SAP Joule for Consultants, enhanced with NVIDIA NeMo Retriever microservices, enables consultants to quickly access relevant insights from SAP-exclusive content, reducing time spent on documentation and troubleshooting. For developers, Joule for developers, powered by NVIDIA NIM microservices, accelerates ABAP code generation, improving code quality and accelerating innovation. These advancements are revolutionizing how enterprises implement SAP solutions and develop applications on SAP Business Technology Platform.
Share:
References :
Classification: |
BenchmarksBlogsResearch Tools |