SAP NetWeaver Visual Composer Metadata Uploader 무인증 원격 코드 실행(RCE) 취약점 긴급 분석 (CVE-2025-31324)

# Nginx Reverse Proxy를 통한 취약 경로 차단 설정 예시
server {
    listen 80;
    server_name sap-app.internal;

    # Visual Composer Metadata Uploader 경로에 대한 외부 접근 차단
    location ~* /VC/.*MetadataUploader {
        deny all;
        return 403 'Access Denied: Unauthorized Access to Metadata Uploader is Blocked.';
    }

    location / {
        proxy_pass http://sap_backend_servers;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

#!/bin/bash
# SAP NetWeaver HTTP 액세스 로그 디렉터리 경로 설정
LOG_DIR='/usr/sap/usr/sap/*/j2ee/cluster/server*/log/system'

echo '[+] Scanning SAP NetWeaver HTTP Access Logs for CVE-2025-31324 exploitation attempts...'

# Metadata Uploader 호출 및 HTTP 200/201 성공 응답 필터링
if [ -d /usr/sap ]; then
    grep -riE 'MetadataUploader|VC.*Uploader' $LOG_DIR | grep -E 'POST|GET' | grep -E ' 200 | 201 ' > /tmp/suspicious_uploader_hits.log
    
    if [ -s /tmp/suspicious_uploader_hits.log ]; then
        echo '[!] WARNING: Suspicious access to Metadata Uploader detected!'
        cat /tmp/suspicious_uploader_hits.log
    else
        echo '[+] No suspicious Metadata Uploader access logs found.'
    fi
else
    echo '[-] SAP directory not found on this host.'
fi