Johannes Ullrich at SANS ISC spotted new URLs in honeypot data tied to a campaign against SAP NetWeaver. Some requests try to exploit CVE-2025-31324, a CVSS 10 bug that allows unauthenticated file uploads. Others just look for webshells earlier attackers already dropped, usually under /irj/servlet_jsp/irj/root/.
The same source also probes non-SAP paths, including a misspelled “upload.aspx.”
My take
The bug is old, but attackers are now shopping for doors someone else already opened. If you run NetWeaver, patching isn’t enough. Check that directory for JSP files you didn’t put there, and if you find one, assume the box is compromised.
God Bless, and Use the Source!
