Coverage › CVE-2017-12637

CVE-2017-12637 Mapped Partial Sigma

SAP NetWeaver Directory Traversal Vulnerability

Vendor / product

SAP — NetWeaver

Description (CISA)

SAP NetWeaver Application Server (AS) Java contains a directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS that allows a remote attacker to read arbitrary files via a .. (dot dot) in the query string.

Added to KEV

2025-03-19

Due date

2025-04-09

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Known ransomware use

Unknown

CWE

CWE-22

CISA notes

SAP users must have an account to log in and access the patch: https://me.sap.com/notes/3476549
https://nvd.nist.gov/vuln/detail/CVE-2017-12637

Elsewhere

cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

4 mapping objects across 4 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1083 File and Directory Discovery primary impact

• DET0370 Recursive Enumeration of Files and Directories Across Privilege Contexts
  AN1040 Windows

  Execution of file enumeration commands (e.g., 'dir', 'tree') from non-standard processes or unusual user contexts, followed by recursive directory traversal or access to sensitive locations.

  WinEventLog:Security EventCode=4688 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

  Tunable: CommandLineRegex UserContext TimeWindow
  AN1041 Linux

  Use of file enumeration commands (e.g., 'ls', 'find', 'locate') executed by suspicious users or scripts accessing broad file hierarchies or restricted directories.

  auditd:SYSCALL execve → DC0032 Process Creation

  auditd:PATH PATH → DC0055 File Access

  Tunable: FilePathDepth UserContext
  AN1042 macOS

  Execution of file or directory discovery commands (e.g., 'ls', 'find') from terminal or script-based tooling, especially outside normal user workflows.

  macos:unifiedlog log collect --predicate → DC0032 Process Creation

  fs:fsusage Filesystem Call Monitoring → DC0055 File Access

  Tunable: PredicateScope TimeWindow
  AN1043 ESXi

  Execution of esxcli commands to enumerate datastore, configuration files, or directory structures by unauthorized or remote users.

  esxi:shell Shell Access/Command Execution → DC0064 Command Execution

  esxi:hostd vSphere File API Access → DC0055 File Access

  Tunable: CLICommandPattern AccessSource
  AN1044 Network Devices

  Execution of file discovery commands (e.g., 'dir', 'show flash', 'nvram:') from CLI interfaces, especially by unauthorized users or from abnormal source IPs.

  networkdevice:syslog CLI Command Logging → DC0064 Command Execution

  Tunable: CommandWhitelist SessionOrigin

Sigma rules tagged attack.t1083 (24)

All 24 rules on the technique page →

T1190 Exploit Public-Facing Application exploitation technique

• DET0080 Exploit Public-Facing Application – multi-signal correlation (request → error → post-exploit process/egress)
  AN0219 Windows

  Adversary sends crafted HTTP/S (or other service) input to an Internet-facing app (IIS/ASP.NET, API, device portal). Chain: (1) abnormal request patterns to public endpoint → (2) elevated 4xx/5xx or unusual methods/paths → (3) server process (w3wp.exe/other service) spawns shell/LOLbins or loads non-standard modules → (4) optional outbound callback from the host/container.

  ApplicationLog:IIS IIS W3C logs in C:\inetpub\logs\LogFiles\W3SVC* (spikes in 5xx, RCE/SQLi/path traversal/JNDI patterns) → DC0038 Application Log Content

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=7 → DC0016 Module Load

  WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

  Tunable: PublicVIPs SuspiciousPatterns ErrorRateThreshold TimeWindow AllowedChildList
  AN0220 Linux

  Adversary exploits Apache/Nginx/app servers. Chain: (1) suspicious requests in access logs → (2) spike of 5xx or WAF blocks → (3) web server or interpreter (apache2/nginx/php-fpm/node/python) spawns /bin/sh, curl, wget, socat, or writes webshell → (4) outbound callback.

  ApplicationLog:WebServer /var/log/httpd/access_log, /var/log/apache2/access.log, /var/log/nginx/access.log with exploit indicators and burst errors → DC0038 Application Log Content

  auditd:SYSCALL execve → DC0032 Process Creation

  NSM:Flow HTTP payloads with SQLi/LFI/JNDI/deserialization indicators → DC0085 Network Traffic Content

  Tunable: WebProcList ChildToolList BurstThreshold TimeWindow
  AN0221 macOS

  Adversary targets macOS-hosted public services (e.g., nginx, node). Chain: suspicious inbound request → service crash/5xx → service spawns shell or writes file → new outbound connection.

  macos:unifiedlog App/web server logs ingested via unified logging or filebeat (nginx/apache/node). → DC0038 Application Log Content

  macos:unifiedlog exec events where web process starts a shell/tooling → DC0032 Process Creation

  NSM:Flow outbound egress from web host after suspicious request → DC0085 Network Traffic Content

  Tunable: ServiceList TimeWindow
  AN0222 Containers

  Adversary exploits containerized app via ingress or service. Chain: (1) suspicious request in ingress/app logs → (2) container process spawns a shell/exec/sidecar (kubectl exec/docker exec) → (3) egress to Internet or metadata service (169.254.169.254).

  ApplicationLog:Ingress Kubernetes NGINX/Envoy ingress controller logs with anomalous payloads and 5xx spikes → DC0038 Application Log Content

  docker:events Docker/Kubernetes audit of exec/attach (kubectl exec) or unexpected child processes inside container → DC0032 Process Creation

  NSM:Flow Requests towards cloud metadata or command & control from pod IPs → DC0085 Network Traffic Content

  Tunable: IngressNamespaces MetadataEndpoints TimeWindow
  AN0223 IaaS

  Adversary targets cloud-hosted public endpoints. Chain: (1) ALB/ELB/Cloud LB logs show exploit-like inputs or error spikes → (2) workload spawns shell or reaches metadata API → (3) egress to new external hosts.

  ALB:HTTPLogs AWS ALB/ELB/GCP/Azure Application Gateway HTTP logs with unusual methods, long URIs, serialized payloads, 4xx/5xx bursts → DC0085 Network Traffic Content

  AWS:VPCFlowLogs VPC/NSG flow logs for pod/instance egress to Internet or metadata → DC0078 Network Traffic Flow

  Tunable: LBProjects ErrorBurst
  AN0224 ESXi

  Adversary exploits exposed OpenSLP on ESXi or vCenter public endpoints. Chain: inbound request pattern to mgmt service → hostd/vpxd error/crash/restart → unexpected process behavior or datastore access → outbound callback.

  esxi:hostd /var/log/hostd.log anomalies (faults, crashes, restarts) around inbound connections → DC0038 Application Log Content

  NSM:Flow Connections to TCP 427 (SLP) or vCenter web services from untrusted sources → DC0085 Network Traffic Content

  Tunable: MgmtCIDR TimeWindow
  AN0225 Network Devices

  Adversary exploits public admin services on routers/firewalls/switches. Chain: anomalous HTTP/SNMP/SmartInstall inputs → device syslog errors/restarts → config changes/CLI spawn → egress to attacker C2.

  networkdevice:controlplane Syslog from edge devices with HTTP 500s on mgmt portal, SmartInstall events, unexpected CLI commands → DC0038 Application Log Content

  NSM:Flow NetFlow/sFlow for odd egress to Internet from mgmt plane → DC0085 Network Traffic Content

  Tunable: MgmtPorts TrustedAdmins

Sigma rules tagged attack.t1190 (149)

All 149 rules on the technique page →

T1555 Credentials from Password Stores secondary impact

• DET0430 Detect Credentials Access from Password Stores
  AN1198 Windows

  Monitors suspicious access to password stores such as LSASS, DPAPI, Windows Credential Manager, or browser credential databases. Detects anomalous process-to-process access (e.g., Mimikatz accessing LSASS) and correlation of credential store file reads with execution of non-standard processes.

  WinEventLog:Sysmon EventCode=10 → DC0035 Process Access

  WinEventLog:Security EventCode=4663, 4670, 4656 → DC0055 File Access

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  Tunable: TargetProcesses KeywordPatterns
  AN1199 Linux

  Detects access to known password store files (e.g., /etc/shadow, GNOME Keyring, KWallet, browser credential databases). Monitors anomalous process read attempts and suspicious API calls that attempt to extract stored credentials.

  auditd:SYSCALL open/read → DC0055 File Access

  auditd:EXECVE execve → DC0032 Process Creation

  Tunable: MonitoredFiles SuspiciousCommands
  AN1200 macOS

  Monitors Keychain database access and suspicious invocations of security and osascript utilities. Correlates process execution with attempts to dump or unlock Keychain data.

  macos:unifiedlog access to keychain database → DC0055 File Access

  macos:unifiedlog execution of security or osascript → DC0032 Process Creation

  Tunable: AllowedApplications AlertThreshold
  AN1201 IaaS

  Detects attempts to access or enumerate cloud password/secrets storage services such as AWS Secrets Manager, Azure Key Vault, or GCP Secret Manager. Monitors API calls for abnormal enumeration or bulk retrieval of secrets.

  AWS:CloudTrail GetSecretValue → DC0083 Cloud Service Enumeration

  AWS:CloudTrail Decrypt → DC0021 OS API Execution

  Tunable: UserContext AccessThreshold

Sigma rules tagged attack.t1555 (8)

T1592 Gather Victim Host Information secondary impact

• DET0826 Detection of Gather Victim Host Information
  AN1958 PRE

  Internet scanners may be used to look for patterns associated with malicious content designed to collect host information from visitors. Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.

  Internet Scan None → DC0104 Response Content

Sigma rules tagged attack.t1592 (0)

None. MITRE's strategy above is the only public detection guidance for this technique.