CVE-2016-3976
SAP NetWeaver Directory Traversal Vulnerability
Description
CVE-2016-3976 is a high-severity directory traversal vulnerability in SAP NetWeaver Application Server Java. The flaw exists in the CrashFileDownloadServlet, which fails to properly sanitize the fileName parameter, allowing remote attackers to read arbitrary files on the server by supplying path traversal sequences such as dot-dot-backslash. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. With an EPSS score of 81.47% (99.2nd percentile), CVE-2016-3976 has a very high probability of exploitation, making immediate remediation critical for organizations running affected SAP NetWeaver versions.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| sap | netweaver application server java | >= 7.10, <= 7.50 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- http://packetstormsecurity.com/files/137528/SAP-NetWeaver-AS-JAVA-7.5-Directory-Traversal.html(Exploit, Third Party Advisory, VDB Entry)
- http://seclists.org/fulldisclosure/2016/Jun/40(Exploit, Mailing List, Third Party Advisory)
- https://erpscan.io/advisories/erpscan-16-012/(Third Party Advisory)
- https://erpscan.io/press-center/blog/sap-security-notes-march-2016-review/(Third Party Advisory)
- https://launchpad.support.sap.com/#/notes/2234971(Permissions Required)
- https://www.exploit-db.com/exploits/39996/(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3976(US Government Resource)
Weakness Type
CWE-22: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)
Path traversal vulnerabilities occur when software uses external input to construct a file path without properly neutralizing special elements such as ".." sequences. In the case of CVE-2016-3976, the SAP NetWeaver CrashFileDownloadServlet accepts a fileName parameter that is not adequately validated, allowing attackers to traverse directory boundaries and access files outside the intended directory.
Learn more: CWE-22 — Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)
Impact Analysis
CVE-2016-3976 carries a CVSS 3.1 score of 7.5 (HIGH), reflecting significant risk to affected SAP environments. The vulnerability is remotely exploitable over the network with low attack complexity and requires no authentication or user interaction, making it trivially accessible to any attacker with network access to the SAP NetWeaver instance. Confidentiality (High): Successful exploitation allows attackers to read arbitrary files from the server, potentially exposing sensitive configuration files, credentials, database connection strings, and business-critical data. Integrity (None) and Availability (None): The vulnerability is limited to unauthorized file reads and does not directly allow modification or destruction of data. The EPSS score of 81.47% indicates that this vulnerability is highly likely to be exploited, and organizations should treat patching as an urgent priority.
Exploit Maturity
Public exploit code is available for CVE-2016-3976 via Packet Storm Security and Exploit-DB, significantly lowering the barrier to exploitation. CISA has confirmed active exploitation of this vulnerability by adding it to the Known Exploited Vulnerabilities catalog. The EPSS score of 81.47% (99.2nd percentile) indicates near-certain exploitation activity, placing this vulnerability among the most actively targeted flaws. Full disclosure details have also been published on the Full Disclosure mailing list, providing additional technical information that attackers can leverage.
Remediation
- Apply SAP Security Note 2234971 immediately as required by CISA KEV. This patch addresses the directory traversal vulnerability in the CrashFileDownloadServlet component.
- Upgrade SAP NetWeaver Application Server Java to a version beyond 7.50 that includes the security fix. Affected versions range from 7.10 through 7.50.
- If immediate patching is not feasible, restrict network access to the CrashFileDownloadServlet endpoint using web application firewall (WAF) rules or reverse proxy configurations. Block requests containing path traversal sequences ("../" and ".." patterns) in the fileName parameter.
- Review server access logs for evidence of exploitation attempts, specifically looking for requests to CrashFileDownloadServlet with suspicious fileName values containing directory traversal sequences.
- Implement strict input validation on all file-serving endpoints, using an allowlist of permitted filenames rather than attempting to filter malicious patterns. Canonicalize file paths before access to prevent traversal bypass techniques.
Technical Details
CVE-2016-3976 exploits a directory traversal weakness in the CrashFileDownloadServlet of SAP NetWeaver Application Server Java versions 7.1 through 7.5. The servlet accepts a fileName parameter that is passed directly to file system operations without adequate sanitization. By injecting ".." (dot-dot-backslash) sequences into the fileName parameter, an attacker can escape the intended directory and read arbitrary files on the server. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms that the attack is network-based, requires no special conditions, privileges, or user interaction, and results in high confidentiality impact with no effect on integrity or availability. The use of backslash separators in the traversal payload indicates that the vulnerability specifically targets Windows-hosted SAP instances, though forward-slash variants may also work depending on the underlying operating system.
Frequently Asked Questions
Is CVE-2016-3976 being actively exploited?
Yes. CVE-2016-3976 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Multiple public exploits are available, and the EPSS score of 81.47% (99.2nd percentile) indicates very high exploitation activity.
What products are affected by CVE-2016-3976?
CVE-2016-3976 affects SAP NetWeaver Application Server Java versions 7.10 through 7.50. The vulnerable component is the CrashFileDownloadServlet, which is part of the default SAP NetWeaver installation.
How do I fix CVE-2016-3976?
Apply SAP Security Note 2234971 to patch the directory traversal vulnerability. Upgrade affected SAP NetWeaver instances beyond version 7.50. As an interim measure, block access to the CrashFileDownloadServlet endpoint or deploy WAF rules to filter path traversal patterns.
How severe is CVE-2016-3976?
CVE-2016-3976 has a CVSS 3.1 score of 7.5 (HIGH). While the vulnerability is limited to reading files rather than modifying them, the ability to access arbitrary server files including configuration data and credentials makes it a serious threat. The 99.2nd percentile EPSS ranking underscores the urgency of remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.