CVE-2025-31324 Burp Suite Extension

Overview

This Python-based Burp Suite extension is designed to detect the presence of CVE-2025-31324, a critical vulnerability in SAP NetWeaver Visual Composer’s Metadata Uploader component. The vulnerability allows unauthenticated remote code execution via file upload due to a missing authorization check. The extension performs active scanning by sending a test file to the /developmentserver/metadatauploader endpoint and checks for indicators of successful upload.

Note: This tool is for ethical security testing only. Use it only on systems you have explicit permission to test. Unauthorized use may be illegal and unethical.

Features

• Actively scans for CVE-2025-31324 by attempting a benign file upload.
• Reports findings as custom issues in Burp’s Issue Activity with detailed evidence.
• Compatible with Jython (Python 2.x) for Burp Suite integration.

Prerequisites

• Burp Suite Professional (Community Edition may have limitations).
• Jython (standalone JAR, version compatible with Burp Suite).
• A target SAP NetWeaver application within Burp’s scope.

Installation

1. Set Up Jython in Burp Suite:

   • Download the Jython standalone JAR from jython.org.
   • In Burp Suite, navigate to Extender > Options > Python Environment.
   • Select the Jython JAR file as the Python environment.

2. Load the Extension:

   • Save the extension code as cve_2025_31324_scanner.py (ensure you have the script from the provided source).
   • In Burp Suite, go to Extender > Extensions > Add.
   • Set the extension type to Python and select the cve_2025_31324_scanner.py file.
   • Confirm the extension loads successfully (check the Output tab for "CVE-2025-31324 Scanner loaded successfully").

Usage

1. Configure Burp Suite:

   • Add the target SAP NetWeaver application to Burp’s scope (e.g., via Target > Site map > Add to scope).
   • Ensure the target includes the /developmentserver/metadatauploader endpoint.

2. Run the Scan:

   • Start an active scan on the target (Scanner > New scan > select the target).
   • The extension will automatically test requests to the vulnerable endpoint.
   • Monitor the Issues tab for reported vulnerabilities under "CVE-2025-31324: SAP NetWeaver File Upload Vulnerability".

3. Interpret Results:

   • If the extension detects a potential vulnerability, it will report a High severity issue with evidence (e.g., "HTTP 200 received, indicating potential file upload success").
   • Manually verify findings to confirm the vulnerability, as HTTP 200 responses may not always indicate successful exploitation.

Ethical Considerations

• Authorized Use Only: Only test systems where you have explicit permission from the owner. Unauthorized scanning or exploitation is illegal and unethical.
• Benign Testing: The extension uploads a harmless text file (test_cve_2025_31324.txt) to avoid causing harm. Do not modify the payload to include malicious code unless explicitly authorized.
• Responsible Disclosure: Report any discovered vulnerabilities to the system owner promptly and follow responsible disclosure practices.

Limitations

• False Positives: An HTTP 200 response does not guarantee a vulnerability. Manual verification is required to confirm file upload and potential code execution.
• Jython Compatibility: The extension uses Python 2.x syntax due to Burp Suite’s Jython environment. Ensure compatibility with your Burp Suite version.
• Basic Detection: The extension checks for basic success indicators. Advanced exploitation (e.g., executing uploaded files) is not implemented to prevent harm.

Customization

To adapt the extension for specific environments:

• Modify the boundary or test_filename in cve_2025_31324_scanner.py to match server requirements.
• Adjust response checks (e.g., specific strings in the response body) for more precise detection.
• Add additional payloads or endpoints if the target uses non-standard configurations.

References

• CVE-2025-31324 Details: National Vulnerability Database (NVD) entry for CVE-2025-31324.
• SAP Security Note: Apply SAP Security Note 3594142 to patch the vulnerability (see SAP’s official documentation).
• Burp Suite Extension Guide: PortSwigger’s documentation on writing custom scanner checks.
• Vulnerability Information: Tenable Blog and Redrays.io reports on CVE-2025-31324.

License

This project is provided for educational and ethical security testing purposes only. The author is not responsible for misuse or unauthorized use of this tool.

Contact

For issues or suggestions, please open an issue on the project repository (if applicable) or contact the author through authorized channels.

---

Disclaimer: This tool is intended for security researchers and penetration testers with explicit permission to test target systems. Misuse may violate laws and ethical standards.