New 0-Day RFI Vulnerability in SAP NetWeaver Actively Exploited
A series of targeted cyberattacks has uncovered a previously unknown vulnerability in SAP NetWeaver, enabling attackers to deploy malicious JSP webshells and gain unauthorized access to enterprise systems — even those fully updated with the latest patches.
In April 2025, security researchers at ReliaQuest discovered multiple incidents where threat actors exploited this flaw to upload and execute webshells within publicly accessible directories. The activity points to a previously unreported zero-day Remote File Inclusion (RFI) vulnerability in SAP NetWeaver.
RFI Vulnerability Details
The attacks specifically target SAP NetWeaver’s /developmentserver/metadatauploader endpoint, a feature designed to handle metadata files during application development and configuration.
Threat actors exploited a Remote File Inclusion (RFI) flaw where unsanitized user input allowed arbitrary file uploads and execution on the server.
By sending crafted HTTP POST requests, attackers successfully uploaded JavaServer Pages (JSP) webshells into the directory j2ee/cluster/apps/sap.com/irj/servletjsp/irj/root/, providing them persistent backdoor access.
Webshell Deployment and Post-Exploitation Activities
Once the webshells were deployed, attackers gained the ability to execute arbitrary commands on compromised systems by simply issuing HTTP GET requests to the webshell URLs.
This access provided full remote control, allowing them to upload additional malicious files, run arbitrary code, and exfiltrate sensitive data.
The JSP webshells observed — including helper.jsp and cache.jsp — imported Java packages to interact with system processes, offered attacker-facing HTML forms for command input, and displayed command output directly within the browser interface.
Many of these webshells were lightweight and highly compatible with SAP NetWeaver, often based on open-source code repositories.
Following initial access, attackers escalated their operations using advanced post-exploitation tools:
Brute Ratel Deployment
Attackers leveraged the webshells to upload Brute Ratel, a commercial command-and-control (C2) framework.
They wrote malicious C# code to a file (output.txt), moved it into the ProgramData directory, and compiled it using the .NET Framework’s MSBuild utility — establishing a persistent foothold on the compromised systems.
Brute Ratel Post-Exploitation and Evasion Techniques
After deployment, Brute Ratel was used to inject malicious code into the dllhost.exe process, enabling the decryption and in-memory execution of payloads without touching disk.
Brute Ratel is highly valued by threat actors for its encrypted communication channels, flexible payload customization, and powerful post-exploitation features, including privilege escalation and credential harvesting.
Use of Heaven’s Gate for Evasion
To bypass endpoint detection, attackers employed the Heaven’s Gate technique — a method that alters thread execution contexts to seamlessly switch between 32-bit and 64-bit code execution, helping their activity blend in with legitimate system processes.
Exploitation Details and Defensive Recommendations
Attackers achieved evasion by leveraging the Windows API call NtSetContextThread, allowing malicious code to bypass security controls and operate stealthily.
SAP NetWeaver, heavily deployed across government and enterprise environments, remains a high-value target.
Notably, these attacks were observed even on systems running the latest SAP service packs and patches, raising concerns that the vulnerability may represent a true zero-day or an unreported variant of an older issue, such as CVE-2017-9844.
However, current evidence suggests the exploit is distinct from previously patched vulnerabilities, indicating the discovery of a new Remote File Inclusion (RFI) flaw.
There are indications that initial access brokers (IABs) may be involved, potentially selling access to compromised SAP environments in underground forums. Although no direct sales have been confirmed, SAP NetWeaver remains a frequent topic of discussion in cybercriminal communities, further elevating the risk.
Recommended Actions for SAP NetWeaver Administrators
- Disable Legacy Features: Immediately disable Visual Composer and the developmentserver application alias, both of which are exploited in this campaign.
- Restrict Access: Limit access to the
/developmentserver/metadatauploaderendpoint using strict firewall rules. - Enhance Logging and Monitoring: Centralize logs and monitor for suspicious activity, particularly unauthorized uploads within
j2ee/cluster/apps/sap.com/irj/servletjsp/irj/root/. - Scan for Webshells: Actively scan for known webshell indicators, including the hashes associated with
helper.jspandcache.jsp.
This campaign underscores the persistent threat of zero-day vulnerabilities within critical business platforms like SAP NetWeaver.
Organizations are urged to strengthen their security posture, apply available mitigations, and maintain heightened vigilance as investigations into the root cause continue.
