CVE-2017-12637
SAP NetWeaver Directory Traversal Vulnerability
Description
CVE-2017-12637 is a high-severity directory traversal vulnerability in SAP NetWeaver Application Server Java 7.5 that allows remote, unauthenticated attackers to read arbitrary files from the server. The vulnerability exists in the scheduler/ui/js/ endpoint, where a specially crafted query string containing ".." (dot dot) sequences can escape the intended directory and access sensitive files on the underlying file system. With a CVSS v3.1 score of 7.5 and an extraordinary EPSS score of 93.22% at the 99.8th percentile, CVE-2017-12637 is among the most actively targeted vulnerabilities ever tracked. CISA has added it to the Known Exploited Vulnerabilities catalog, confirming exploitation in the wild since at least August 2017.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| sap | netweaver application server java | 7.50 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://web.archive.org/web/20170807202056/http://www.sh0w.top/index.php/archives/7/(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-12637(US Government Resource)
Weakness Type
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2017-12637 is classified under CWE-22 (Path Traversal), a vulnerability where software constructs a file path using user input without properly neutralizing special elements like ".." sequences that can resolve to locations outside the intended directory. In SAP NetWeaver Application Server Java, the scheduler UI JavaScript endpoint fails to sanitize directory traversal sequences in the query string, allowing attackers to navigate upward through the directory hierarchy and access arbitrary files readable by the application process.
Learn more: CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Impact Analysis
CVE-2017-12637 enables unauthenticated remote file disclosure on SAP NetWeaver Application Server Java 7.5 instances. The vulnerability is network-accessible (AV:N) with low complexity (AC:L), requires no authentication (PR:N) and no user interaction (UI:N), making it trivially exploitable against any internet-facing instance. Confidentiality (High) is severely impacted as attackers can read arbitrary files from the server, including SAP configuration files containing database credentials, LDAP connection strings, encryption keys, user data, and operating system files such as /etc/passwd. While integrity and availability are not directly affected, the disclosure of credentials and configuration data enables follow-on attacks that can lead to full system compromise. The EPSS score of 93.22% at the 99.8th percentile — placing it in the top 0.2% of all vulnerabilities — confirms that exploitation is near-certain against any exposed instance.
Exploit Maturity
CVE-2017-12637 has extremely high exploit maturity, having been exploited in the wild since August 2017. CISA has confirmed active exploitation by adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of April 9, 2025. The EPSS score of 93.22% at the 99.8th percentile places it among the top 0.2% of all tracked vulnerabilities in terms of exploitation probability. The simplicity of the attack — appending directory traversal sequences to a URL query string — means no specialized tooling is required, and exploitation can be performed with a standard web browser or curl command. SAP systems are high-value targets due to the critical business data they manage, making this vulnerability particularly attractive to both opportunistic and advanced threat actors.
Remediation
-
Apply SAP Security Note 2486657 immediately. This patch addresses the directory traversal vulnerability in the scheduler UI component of SAP NetWeaver Application Server Java 7.5. Verify the patch is applied by testing that traversal sequences in the affected endpoint no longer return file contents.
-
Restrict network access to the SAP NetWeaver Application Server, particularly the scheduler/ui/js/ endpoint. Implement firewall rules or reverse proxy configurations to limit access to trusted IP ranges and authenticated users only.
-
Deploy Web Application Firewall (WAF) rules to detect and block HTTP requests containing directory traversal patterns ("../", "..%2f", "%2e%2e/", etc.) targeting the SAP NetWeaver endpoints. Ensure rules cover URL-encoded and double-encoded variants.
-
Conduct a forensic assessment of any SAP NetWeaver instances that were running version 7.5 while exposed to untrusted networks. Review web server access logs for requests containing ".." sequences in the scheduler endpoint path. Rotate all credentials stored on or accessible from the SAP server, including database passwords, LDAP bind credentials, and encryption keys.
-
Implement path validation controls at the application layer as a long-term hardening measure. Use canonical path resolution to verify that requested files fall within the intended directory before serving them, and restrict the application process file system permissions to the minimum required.
Technical Details
CVE-2017-12637 is a directory traversal vulnerability in SAP NetWeaver Application Server Java 7.5, specifically in the scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS endpoint. The vulnerability is triggered by including ".." (dot dot) sequences in the query string of HTTP requests to this endpoint. The server-side code constructs a file path by concatenating the user-supplied query string with a base directory path, but fails to sanitize or validate the input for directory traversal characters. As a result, sequences like "../../../../../../etc/passwd" cause the path to resolve outside the intended JavaScript resource directory, allowing the attacker to read any file accessible to the SAP application process. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N confirms the attack is unauthenticated, network-accessible, and results in high confidentiality impact with no effect on integrity or availability.
Frequently Asked Questions
Is CVE-2017-12637 being actively exploited?
Yes. CVE-2017-12637 has been exploited in the wild since at least August 2017, and CISA has confirmed ongoing active exploitation. The EPSS score of 93.22% at the 99.8th percentile indicates near-certain exploitation against any exposed instance.
What products are affected by CVE-2017-12637?
SAP NetWeaver Application Server Java version 7.50 is affected. The vulnerability specifically targets the scheduler/ui/js/ endpoint used for serving JavaScript resources in the scheduler user interface.
How do I fix CVE-2017-12637?
Apply SAP Security Note 2486657, which patches the directory traversal vulnerability. Additionally, restrict network access to the affected endpoint and implement WAF rules to block traversal patterns.
How severe is CVE-2017-12637?
CVE-2017-12637 is rated High with a CVSS score of 7.5. While it only enables file reading (not writing or execution), the ability to read arbitrary files from SAP systems can expose database credentials, encryption keys, and business-critical data, enabling further attacks.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.