Attackers Searching for SAP Netweaver Webshells, (Mon, Nov 9th)

Just saw a new (to me) URL in our honeypot data today:

/irj/servlet_jsp/irj/root/ant.jsp

Exploit Campaign

This request is part of a larger campaign to exploit SAP NetWeaver or to find already installed webshells. The exploited vulnerability is "old": CVE-2025-31324.

A perfect 10 CVSS score and the simple ability to upload files without authentication. Attackers have been using this vulnerability to upload webshells. Usually, these webshells end up in /irj/servlet_jsp/irj/root/.

One particular attacker, 82.26.72.21, is hitting the following URLs. Not all of these URLs are SAP NetWeaver-related. Also, check the odd misspelling of "upload.aspx" at the end.

• /
• /_layouts/15/start.aspx
• /_layouts/15/ToolPane.aspx?DisplayMode=Edit&a=/ToolPane.aspx
• /amp/upload
• /ant.aspx
• /ant.jsp
• /ant.jsp/
• /ant.php
• /api/upload
• /api/v1/upload
• /authenticationendpoint/ant.jsp
• /commandcenter/ant.jsp
• /commandcenter/deployWebpackage.do
• /developmentserver/metadatauploader?CONTENTTYPE=MODEL&CLIENT=1
• /en-US/static/app/search/ant.php
• /fileupload/toolsAny
• /hosted/amp/upload
• /images/ant.php
• /images/pagebuilder/ant.php
• /index.action
• /index.php?option=com_baforms&task=uploader.upload
• /index.php?option=com_gridbox&task=uploader.upload
• /index.php?option=com_jce&task=plugin.display&plugin=browser
• /index.php?option=com_sppagebuilder&task=media.directUpload
• /irj/servlet_jsp/irj/root/ant.jsp
• /m/webadmin/upload
• /MagicInfo/ant.jsp
• /MagicInfo/servlet/SWUpdateFileUploader
• /NmConsole/ant.aspx
• /NmConsole/Wug/Report/ExportReport
• /Synchronization
• /te/upload
• /upload.apsx
• /upload.aspx

Author

Johannes B. Ullrich, Ph.D. , Dean of Research, SANS.edu Twitter|

Keywords: sap netweaver 1 comment(s) Click HERE to learn more about classes Johannes is teaching for SANS × Diary Archives Comments