Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2017-12617GHSA-XJGH-84HX-56C5

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g.

Affects Apache Tomcat 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0-RC1 to 8.0.46 and 7.0.0 to 7.0.81 when a servlet context uses readonly=false and HTTP PUT is allowed. Fixed in 9.0.1, 8.5.23, 8.0.47 and 7.0.82.

Published
Last modified
published
Listed in CISA KEV
Actively exploited
Fix
Fixed in 9.0.1, 8.5.23, 8.0.47, 7.0.82
None on Exploit-DB, Metasploit or GitHub

Summary

Apache Tomcat, a widely used Java web server, is affected when HTTP PUT requests are enabled on the Default servlet. An attacker could upload a JSP file through a specially crafted request, and the server would then run any code contained in that file when it is requested, potentially giving the attacker control over the server.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Read the original description

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

Timeline

  1. CVE published
  2. Added to CISA KEV

    CISA has evidence of exploitation in the wild

  3. CISA remediation deadline

    Due date for US federal agencies to patch

  4. Record last updated
  5. EPSS reached 10%

    FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

  • Apache Software Foundation Apache Tomcat

    9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46, 7.0.0 to 7.0.81

  • org.apache.tomcat:tomcat-catalinaMaven

    From 9.0.0.M1 · fixed in 9.0.1

  • org.apache.tomcat:tomcat-catalinaMaven

    From 8.5.0 · fixed in 8.5.23

  • org.apache.tomcat:tomcat-catalinaMaven

    From 8.0.0-RC1 · fixed in 8.0.47

  • org.apache.tomcat:tomcat-catalinaMaven

    From 7.0.0 · fixed in 7.0.82

  • org.apache.tomcat.embed:tomcat-embed-coreMaven

    From 9.0.0.M1 · fixed in 9.0.1

  • org.apache.tomcat.embed:tomcat-embed-coreMaven

    From 8.5.0 · fixed in 8.5.23

  • org.apache.tomcat.embed:tomcat-embed-coreMaven

    From 8.0.0-RC1 · fixed in 8.0.47

  • org.apache.tomcat.embed:tomcat-embed-coreMaven

    From 7.0.0 · fixed in 7.0.82

References 25

access.redhat.com

oracle.com

support.hpe.com

Exploit-DB

lists.debian.org

usn.ubuntu.com

securitytracker.com

securityfocus.com

lists.apache.org

security.netapp.com

FAQ

Questions about CVE-2017-12617

What does this mean?

When a servlet context is configured with readonly=false and HTTP PUT requests are allowed, a remote user can upload a JSP file to that context. The uploaded JSP can then be run, which allows code execution.Source: access.redhat.com

Am I affected, and how do I check?

The affected releases are Tomcat 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0-RC1 to 8.0.46 and 7.0.0 to 7.0.81. To check a installation, look at the Tomcat version reported by the version script or catalina.sh version, and check whether the readonly setting for the servlet context, or the DefaultServlet readonly parameter, is false and whether PUT is allowed.Source: access.redhat.com

What should I do about it?

Upgrade to Tomcat 9.0.1, 8.5.23, 8.0.47, 7.0.82 or a later release in the same branch.Source: access.redhat.com

Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-03-25, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data