Quick Takeaways
- CVE-2025-31324 enables unauthenticated file uploads to SAP NetWeaver (CVSS 10.0), which attackers use to plant webshells.
- Webshells commonly target
/irj/servlet_jsp/irj/root/; the observed probe/irj/servlet_jsp/irj/root/ant.jspmay indicate shell discovery or deployment. 82.26.72.21probes numerous upload and exploit paths across platforms, including the misspelled/upload.apsx.
Threat, Techniques, and Targets
Threat: Attackers are targeting SAP NetWeaver to exploit CVE 2025 31324, which carries a CVSS score of 10.0. The flaw allows unauthenticated file uploads.
Techniques: Attackers use the flaw to upload webshells, often to /irj/servlet_jsp/irj/root/. Recent honeypot data recorded a request for /irj/servlet_jsp/irj/root/ant.jsp. In addition, attacker IP address 82.26.72.21 probed many upload paths and webshell names, including /ant.jsp, /ant.php, and /upload.apsx. Some requests do not relate to SAP NetWeaver.
Targets: The campaign targets SAP NetWeaver systems and also probes paths associated with other products and upload tools.
Impact, Security Implications, and Remediation
Impact: Attackers can upload webshells without authentication. This creates a serious risk for systems exposed to the flaw. The source does not describe further impacts.
Security implications: Therefore, teams should review SAP NetWeaver logs for requests to the listed paths, especially the webshell path under /irj/servlet_jsp/irj/root/. The source does not confirm that every probe led to a successful upload.
Remediation: The source provides no specific remediation steps. Obtain current patching and mitigation guidance from SAP or the relevant security authority.
Continue Your Tech Journey
Learn how the Internet of Things (IoT) is transforming everyday life.
Discover archived knowledge and digital history on the Internet Archive.
ThreatIntel-V1
