Remote code execution in Apache Tomcat - CVE-2017-12615

Vulnerability identifier: #VU8541

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-12615

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: The vulnerability is being exploited in the wild

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists in Apache Tomcat when running on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) due to input validation flaw. A remote attacker can send a specially crafted HTTP PUT request to upload an arbitrary JSP file to the target system and request the file to execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability may result in system compromise.

Apache Tomcat
JBoss Enterprise Web Server
Red Hat Enterprise Linux for x86_64
Fedora
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux EUS Compute Node
SUSE Linux
tomcat

Update to version 7.0.81.

tomcat - addressed in versions 7.0.82-1.el6, 8.0.47-1.fc25, 8.0.47-1.fc26, 8.0.47-1.fc27

• Exploit #8864 - AttackTomcat (Tomcat常见漏洞GUI利用工具。CVE-2017-12615 PUT文件上传漏洞、tomcat-pass-getshell 弱认证部署war包、弱口令爆破、CVE-2020-1938 Tomcat AJP文件读取/包含) (February 22, 2023)
• Exploit #4888 - CVE-2017-12615 (Tomcat 远程代码执行漏洞 Exploit) (November 30, 2020)
• Exploit #4701 - CVE-2017-12615 (Tomcat 远程代码执行漏洞 Exploit) (October 14, 2020)
• Exploit #2304 - exphub (Exphub[漏洞利用脚本库] 包括Webloigc、Struts2、Tomcat、Nexus、Solr、Jboss、Drupal的漏洞利用脚本，最新添加CVE-2020-14882、CVE-2020-11444、CVE-2020-10204、CVE-2020-10199、CVE-2020-1938、CVE-2020-2551、CVE-2020-2555、CVE-2020-2883、CVE-2019-17558、CVE-2019-6340) (April 7, 2020)
• Exploit #2285 - Exploits (Containing Self Made Perl Reproducers / PoC Codes) (April 7, 2020)
• Exploit #161 - CVE-2017-12615 (Tomcat 远程代码执行漏洞 Exploit) (March 18, 2020)
• Exploit #162 - labs (Vulnerability Labs for security analysis) (March 18, 2020)
• Exploit #1328 - Apache Tomcat < 9.0.1 (Beta) / < 8.5.23 / < 8.0.47 / < 7.0.8 - JSP Upload Bypass / Remote Code Execution (1) (March 18, 2020)
• Exploit #1861 - CVE-2017-12615 (POC Exploit for Apache Tomcat 7.0.x CVE-2017-12615 PUT JSP vulnerability.) (March 18, 2020)

• http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.81

• Multiple vulnerabilities in Apache Tomcat
• SUSE Linux update for tomcat
• Red Hat update for jboss
• Red Hat update for jboss
• Red Hat update for jboss
• Red Hat update for jboss
• Red Hat update for Red Hat JBoss Web Server
• Red Hat update for tomcat
• Red Hat update for tomcat6
• Fedora 26 update for tomcat
• Fedora 25 update for tomcat
• Fedora 27 update for tomcat
• Fedora EPEL 6 update for tomcat