CVE-2016-3976

SAP NetWeaver Application Server (Java) contains a directory traversal vulnerability (CWE-22) in its CrashFileDownloadServlet. A remote attacker sends a request to the servlet with a dot-dot-backslash (..\) traversal sequence in the fileName parameter, causing the server to step outside the intended directory and return the contents of arbitrary files. Successful exploitation lets the attacker read sensitive files on the host, such as configuration or credential material, which can support further compromise; no code execution is involved. Any organization running SAP NetWeaver Application Server Java, typically large enterprises with SAP landscapes, is affected. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03, confirming exploitation in the wild, and EPSS assigns a 46.6% probability of exploitation in the next 30 days (99th percentile).

What to do: Apply SAP security updates for NetWeaver AS Java per vendor instructions, as required by CISA's KEV listing. Until patched, restrict network access to the CrashFileDownloadServlet endpoint from untrusted networks and review web logs for requests using dot-dot-backslash (..\) sequences in the fileName parameter. Prioritize internet-facing SAP Java instances, since exploitation is confirmed and the EPSS score indicates high near-term exploitation probability.