Attackers Searching for SAP Netweaver Webshells, (Mon, Nov 9th)

Just saw a new (to me) URL in our honeypot data today: /irj/servlet_jsp/irj/root/ant.jsp This request is part of a larger campaign to exploit SAP NetWeaver or to find already installed webshells. The exploited vulnerability is "old": CVE-2025-31324. A perfect 10 CVSS score and the simple ability to upload files without authentication. Attackers have been using this vulnerability to upload webshells. Usually, these webshells end up in /irj/servlet_jsp/irj/root/. One particular attacker, 82.26.72…

Číst originál na SANS Internet Storm Ctr. →

CZ · EN/orig

SAP US

tg: varování tg: zneužíváno tg: rozbor tp: malware

CVE v události 1

CVE	hodnocení	KEV	EPSS
CVE-2025-31324	10.0 3.1 · sap	KEV ✓	0.99

Hodnocení z katalogů, všechna, se stupnicí CVSS a vydavatelem. Rozpad vektoru je na stránce CVE.