[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Threat Hunting · markdown

honeypot observation (SANS ISC, Johannes Ullrich, Nov 9); CVE-2025-31324 is an older, already-KEV-listed SAP NetWeaver flaw

Hunt: scanners are checking SAP NetWeaver for leftover ant.jsp webshells from CVE-2025-31324, alongside dozens of other upload paths

  • On SAP NetWeaver: look for unexpected .jsp files under /irj/servlet_jsp/irj/root/ and requests to /developmentserver/metadatauploader; a hit on ant.jsp returning 200 means a shell is present.
  • Other paths in the same sweep: /ant.jsp, /ant.aspx, /ant.php, /MagicInfo/servlet/SWUpdateFileUploader, /NmConsole/Wug/Report/ExportReport, /_layouts/15/ToolPane.aspx?DisplayMode=Edit, /commandcenter/deployWebpackage.do and Joomla uploader.upload tasks.
  • Source to block or look up: 82.26.72[.]21.
  • Note the misspelled /upload.apsx in the list, which can make a useful low-noise signature for this scanner.

Sources: SANS ISC diary: Attackers Searching for SAP Netweaver Webshells (Johannes Ullrich, Nov 9)