Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2021-38163 — CVE-2021-38163 - SAP NetWeaver AS Java Desynchronization Vulnerability | Kitploit
Tools/GitHubGitHub/purpleteam-ru/cve-2021-38163
Vulnerability AnalysisExploitationWeb Application ExploitationInformation GatheringPenetration TestingRemote Access Tool
GitHubpurpleteam-ru/cve-2021-38163

CVE-2021-38163

CVE-2021-38163 - SAP NetWeaver AS Java Desynchronization Vulnerability

View Repository
21 year agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2021-38163 - SAP NetWeaver AS Java Desynchronization Vulnerability

Description

CVE-2021-38163 is a security vulnerability in SAP NetWeaver Application Server (AS) Java that allows an authenticated attacker to upload arbitrary files to the server, potentially leading to remote code execution (RCE).

The issue arises due to improper access controls in the Visual Composer Migration Service (com.sap.visualcomposer.VCParMigrator), which fails to properly validate file paths. An attacker can exploit this by:

  • Path Traversal: Bypassing directory restrictions to write files outside intended locations
  • JSP Upload: Deploying a malicious JavaServer Pages (JSP) file to execute arbitrary commands
  • Authentication Bypass: In some configurations, leveraging weak session management to escalate privileges

Affected Versions

  • SAP NetWeaver AS Java (versions before security patch updates in October 2021)

Impact

  • Remote Code Execution (RCE): Execute OS commands with SAP system user privileges
  • Information Disclosure: Access sensitive SAP configuration files
  • Denial of Service (DoS): Disrupt service availability via malicious file uploads

    • Proof of Concept (PoC)

    A functional exploit demonstrating the vulnerability: 🔗 https://github.com/purpleteam-ru/CVE-2021-38163

    Mitigation

    • Apply SAP Security Note #3089838 (SAP login required)
    • Restrict access to /irj/servlet/prt/portal/prtroot/com.sap.visualcomposer.VCParMigrator
    • Implement network segmentation for SAP NetWeaver interfaces

    References

    • SAP Security Patch Day (Oct 2021)
    • CVE-2021-38163 @ NVD

    ⚠️ Warning: Use only on authorized systems. SAP exploitation may violate security policies.

    Download Tool