CVE-2021-38163 PoC — SAP NetWeaver 路径遍历漏洞

Source

https://github.com/purpleteam-ru/CVE-2021-38163

Associated Vulnerability

Title:SAP NetWeaver 路径遍历漏洞 (CVE-2021-38163)
Description:SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can upload a malicious file over a network and trigger its processing, which is capable of running operating system commands with the privilege of the Java Server process. These commands can be used to read or modify any information on the server or shut the server down making it unavailable.

Description

CVE-2021-38163 - SAP NetWeaver AS Java Desynchronization Vulnerability

Readme

# CVE-2021-38163 - SAP NetWeaver AS Java Desynchronization Vulnerability

## Description
CVE-2021-38163 is a security vulnerability in **SAP NetWeaver Application Server (AS) Java** that allows an authenticated attacker to **upload arbitrary files** to the server, potentially leading to **remote code execution (RCE)**.

The issue arises due to improper access controls in the **Visual Composer Migration Service** (`com.sap.visualcomposer.VCParMigrator`), which fails to properly validate file paths. An attacker can exploit this by:
- **Path Traversal**: Bypassing directory restrictions to write files outside intended locations
- **JSP Upload**: Deploying a malicious JavaServer Pages (JSP) file to execute arbitrary commands
- **Authentication Bypass**: In some configurations, leveraging weak session management to escalate privileges

## Affected Versions
- SAP NetWeaver AS Java (versions before security patch updates in **October 2021**)

## Impact
- **Remote Code Execution (RCE)**: Execute OS commands with SAP system user privileges
- **Information Disclosure**: Access sensitive SAP configuration files
- **Denial of Service (DoS)**: Disrupt service availability via malicious file uploads

## Proof of Concept (PoC)
A functional exploit demonstrating the vulnerability:
🔗 [https://github.com/purpleteam-ru/CVE-2021-38163](https://github.com/purpleteam-ru/CVE-2021-38163)

## Mitigation
- Apply SAP Security Note **[#3089838](https://launchpad.support.sap.com/#/notes/3089838)** (SAP login required)
- Restrict access to `/irj/servlet/prt/portal/prtroot/com.sap.visualcomposer.VCParMigrator`
- Implement network segmentation for SAP NetWeaver interfaces

## References
- [SAP Security Patch Day (Oct 2021)](https://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+October+2021)
- [CVE-2021-38163 @ NVD](https://nvd.nist.gov/vuln/detail/CVE-2021-38163)

⚠️ Warning: Use only on authorized systems. SAP exploitation may violate security policies.

File Snapshot


 [4.0K]  /data/pocs/59476844ae2fcce4dba02b691204c1e80cc0d1fb
├── [5.5K]  CVE-2021-38163.py
└── [1.9K]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!