A severe vulnerability in SAP NetWeaver Visual Composer (CVE-2025-31324) has been actively exploited by a Chinese hacker group to compromise enterprise infrastructures globally.
This flaw allows cybercriminals to gain remote code execution by uploading harmful web shells via the exposed /developmentserver/metadatauploader endpoint.
The primary targets of these attacks have been manufacturing organizations, where compromised SAP systems can trigger extensive disruptions and security risks.
The threat actor, named Chaya_004, began using this exploit as early as April 29, 2025, after public availability of proof-of-concept (PoC) exploit code.
Their operations make extensive use of Chinese-based cloud services, including providers like Alibaba, Tencent, and Huawei Cloud.
The attackers’ infrastructure reflects a high level of sophistication, with over 700 IP addresses exhibiting similar setup patterns.
Forescout researchers uncovered this infrastructure by tracing an ELF binary labeled “config” found during one of the attacks.
This binary pointed to an IP hosting a SuperShell login interface, which led to the identification of additional IP addresses with unusual SSL/TLS certificate configurations.
The certificates were uniquely self-signed, imitating Cloudflare certificates, and featured an abnormal subject DN attribute.
Attackers exploit the vulnerability by sending POST requests to the exposed endpoint, resulting in the installation of web shells named “helper.jsp,” “cache.jsp,” or random eight-character strings like “ssonkfrd.jsp.”
Once installed, these backdoors provide the attackers with the ability to download further malicious payloads using curl commands. The attack sequence follows this pattern:
POST /developmentserver/metadatauploader HTTP/1.1
Host: [target]
Content-Type: multipart/form-data; boundary=—————————9051914041544843365972754266
Content-Length: [length]
—————————–9051914041544843365972754266
Content-Disposition: form-data; name=”file”; filename=”webshell.jsp”
Content-Type: application/octet-stream
—————————–9051914041544843365972754266–
The SuperShell backdoors give the hackers full control over compromised systems, enabling them to alter service endpoints, steal credentials, and potentially access more critical SAP components.
The backdoor login interface was found on port 8888 under the path “/supershell/login” on several affected systems.
Organizations using vulnerable SAP versions are strongly advised to apply the security patches released in April 2025 immediately.
Other recommended actions include restricting access to the metadata uploader, disabling unnecessary web services, and setting up real-time monitoring to detect unusual access patterns in SAP systems, especially outside of regular maintenance periods.
