Skip to content

Commit 700667b

Browse files
patel-bhavinpatel-bhavin
authored
Merge pull request #3499 from splunk/weavingbaskets
🕸️ BasketNetWeaving with Haag: No Shell Left Behind!
2 parents be0e06c + 0c67bd0 commit 700667b

File tree

5 files changed

+89
-6
lines changed

5 files changed

+89
-6
lines changed

‎detections/endpoint/java_writing_jsp_file.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Java Writing JSP File
22
id: eb65619c-4f8d-4383-a975-d352765d344b
3-
version: 8
4-
date: '2025-04-22'
3+
version: 9
4+
date: '2025-04-28'
55
author: Michael Haag, Splunk
66
status: production
77
type: TTP
@@ -72,6 +72,7 @@ tags:
7272
- Spring4Shell CVE-2022-22965
7373
- Atlassian Confluence Server and Data Center CVE-2022-26134
7474
- SysAid On-Prem Software CVE-2023-47246 Vulnerability
75+
- SAP NetWeaver Exploitation
7576
asset_type: Endpoint
7677
cve:
7778
- CVE-2022-22965

‎detections/endpoint/windows_java_spawning_shells.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Windows Java Spawning Shells
22
id: 28c81306-5c47-11ec-bfea-acde48001122
3-
version: 9
4-
date: '2024-12-16'
3+
version: 10
4+
date: '2025-04-28'
55
author: Michael Haag, Splunk
66
status: experimental
77
type: TTP
@@ -61,6 +61,7 @@ tags:
6161
- Log4Shell CVE-2021-44228
6262
- SysAid On-Prem Software CVE-2023-47246 Vulnerability
6363
- Cleo File Transfer Software
64+
- SAP NetWeaver Exploitation
6465
asset_type: Endpoint
6566
cve:
6667
- CVE-2021-44228

‎detections/endpoint/windows_process_injection_into_commonly_abused_processes.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Windows Process Injection into Commonly Abused Processes
22
id: 1e1dedc6-f6f3-41a0-9dd7-a1245904fe75
3-
version: 2
4-
date: '2025-04-16'
3+
version: 3
4+
date: '2025-04-28'
55
author: 0xC0FFEEEE, Github Community
66
type: Anomaly
77
status: production
@@ -70,6 +70,7 @@ tags:
7070
analytic_story:
7171
- BishopFox Sliver Adversary Emulation Framework
7272
- Earth Alux
73+
- SAP NetWeaver Exploitation
7374
asset_type: Endpoint
7475
mitre_attack_id:
7576
- T1055.002

‎detections/web/sap_netweaver_visual_composer_exploitation_attempt.yml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
name: SAP NetWeaver Visual Composer Exploitation Attempt
2+
id: a583b9f1-9c3a-4402-9441-b981654dea6c
3+
version: 1
4+
date: '2025-04-28'
5+
author: Michael Haag, Splunk
6+
status: production
7+
type: Hunting
8+
description: |
9+
Detects potential exploitation attempts targeting CVE-2025-31324, a critical unauthenticated file upload vulnerability in SAP NetWeaver Visual Composer. This flaw allows remote attackers to send specially crafted POST requests to the /developmentserver/metadatauploader endpoint, enabling arbitrary file uploads—commonly webshells—resulting in full system compromise. The detection looks for HTTP HEAD or POST requests with a 200 OK status to sensitive Visual Composer endpoints, which may indicate reconnaissance or active exploitation. Successful exploitation can lead to attackers gaining privileged access, deploying malware, and impacting business-critical SAP resources. Immediate patching and investigation of suspicious activity are strongly recommended, as this vulnerability is being actively exploited in the wild.
10+
data_source:
11+
- Suricata
12+
search: '| tstats count min(_time) as firstTime max(_time) as lastTime
13+
from datamodel=Web.Web
14+
where (Web.url IN ("/CTCWebService/CTCWebServiceBean", "/VisualComposer/services/DesignTimeService", "/ctc/CTCWebService/CTCWebServiceBean"))
15+
AND Web.http_method IN ("HEAD", "POST")
16+
AND Web.status=200
17+
by Web.src, Web.dest, Web.http_method, Web.url, Web.http_user_agent, Web.url_length, sourcetype
18+
| `drop_dm_object_name("Web")`
19+
| eval action=case(http_method="HEAD", "Recon/Probe", http_method="POST", "Possible Exploitation")
20+
| `security_content_ctime(firstTime)`
21+
| `security_content_ctime(lastTime)`
22+
| table firstTime, lastTime, src, dest, http_method, action, url, user_agent, url_length, sourcetype
23+
| `sap_netweaver_visual_composer_exploitation_attempt_filter`'
24+
how_to_implement: |
25+
Ensure that the Web data model is accelerated and populated with web server or web proxy logs capturing HTTP request and response data.
26+
This search relies on HTTP method, status code, and URL path fields to identify suspicious access patterns against SAP NetWeaver endpoints.
27+
known_false_positives: |
28+
Some legitimate administrative activity may access SAP NetWeaver services. However, HEAD or POST requests directly resulting in a 200 OK
29+
to Visual Composer endpoints are uncommon and should be investigated carefully.
30+
references:
31+
- https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/
32+
- https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/
33+
- https://www.rapid7.com/blog/post/2025/04/28/etr-active-exploitation-of-sap-netweaver-visual-composer-cve-2025-31324/
34+
tags:
35+
analytic_story:
36+
- SAP NetWeaver Exploitation
37+
asset_type: Web Server
38+
mitre_attack_id:
39+
- T1190
40+
product:
41+
- Splunk Enterprise
42+
- Splunk Enterprise Security
43+
- Splunk Cloud
44+
security_domain: network
45+
cve:
46+
- CVE-2025-31324
47+
tests:
48+
- name: True Positive Test
49+
attack_data:
50+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/sap/suricata_sapnetweaver.log
51+
sourcetype: suricata
52+
source: suricata

‎stories/sap_netweaver_exploitation.yml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
name: SAP NetWeaver Exploitation
2+
id: a52f77e2-0632-46a5-b750-6c059bc7bbb4
3+
version: 1
4+
status: production
5+
date: '2025-04-28'
6+
author: Michael Haag, Splunk
7+
description: |
8+
This Analytic Story covers the detection of exploitation attempts and reconnaissance activity targeting SAP NetWeaver platforms, with a focus on the critical unauthenticated file upload vulnerability CVE-2025-31324 in Visual Composer. Attackers are actively exploiting this flaw to upload arbitrary files—often webshells—via POST requests to the /developmentserver/metadatauploader endpoint, leading to full system compromise, remote code execution, and persistent access. The story includes detections for both probing (e.g., HEAD requests) and active exploitation, and highlights the significant business risks, such as data theft, operational disruption, and potential regulatory impact. Defenders can use this story to monitor, hunt, and respond to suspicious activity across SAP NetWeaver services, helping to identify both initial access and post-exploitation behaviors.
9+
narrative: |
10+
Attackers are actively targeting SAP NetWeaver environments through newly disclosed vulnerabilities like CVE-2025-31324, affecting the Visual Composer service.
11+
Successful exploitation can lead to remote code execution (RCE) and the deployment of webshells, giving adversaries persistent access to SAP systems.
12+
This story provides detections for reconnaissance patterns (e.g., HEAD requests receiving HTTP 200 responses) and potential exploitation behavior
13+
(e.g., POST requests leading to successful uploads), empowering defenders to quickly identify compromise attempts and mitigate them before escalation.
14+
references:
15+
- https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/
16+
- https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/
17+
- https://www.rapid7.com/blog/post/2025/04/28/etr-active-exploitation-of-sap-netweaver-visual-composer-cve-2025-31324/
18+
- https://www.splunk.com/en_us/blog/security/the-final-shell-introducing-shellsweepx.html
19+
tags:
20+
category:
21+
- Adversary Tactics
22+
product:
23+
- Splunk Enterprise
24+
- Splunk Enterprise Security
25+
- Splunk Cloud
26+
usecase: Advanced Threat Detection
27+
cve:
28+
- CVE-2025-31324

0 commit comments

Comments
 (0)