CVE-2017-12615 KEVRansomwarePublic exploit High · 8.1 EPSS 99.7%

Apache Tomcat on Windows Remote Code Execution Vulnerability

Apache · Tomcat

Summary

The flaw is an unrestricted file upload weakness in Apache Tomcat's default servlet on Windows, affecting Tomcat 7.0.0 through 7.0.79. Where HTTP PUT is enabled (for example by setting the default servlet's readonly initialisation parameter to false), an attacker who sends a specially crafted request can upload a JSP file that the server will then execute as code when requested, requiring no authentication or user interaction and only network access to the server.

Official description · NVD

When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

Breakdown

78.7 / 100

Exploited: Yes, in CISA KEV
Reports: 0
Tactics: 2/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

How attackers get in
- Break in through an internet-facing appT1190 · Exploit Public-Facing ApplicationAI-written (claude-haiku-5-5)Medium confidence149 general detection rules
What they do
- Plant a web shell for remote controlT1505.003 · Web ShellAI-written (claude-haiku-5-5)Medium confidence35 general detection rules

First seen exploited 16 months after disclosure. Public exploit code (Exploit-DB) appeared 1 day after disclosure.

Disclosed19 Sep 2017day 0
Public exploit codeExploit-DB20 Sep 2017+1 day
First seen exploitedVulnCheck KEV evidence8 Jan 2019+16 mo
Added to CISA KEVknown ransomware use; EU database agrees25 Mar 2022+5 yrs

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

See the family tree

3 related vulnerabilities in the same code over 3 years. The latest fix listed for tomcat-embed-core is 9.0.1.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

This CVECVE-2017-12615Tomcat on Windows Remote Code Execution19 Sep 2017KEV
Next fix in the same packageMedium
Why these are linked:
- Fixed one release later7.0.79 → 7.0.82 (org.apache.tomcat.embed:tomcat-embed-core)
- Similar weakness in the same product (machine-matched)same product + CWE + description similarity
CVE-2017-12617Tomcat Remote Code Execution4 Oct 2017KEV
relatedMedium
Why these are linked:
- Same code patched: AbstractFileResourceSet.java (machine-matched)Functions: file, isInvalidWindowsFilenamecommit a9dd960 commit 74ad0e2 commit 7f004ac commit 800b031
CVE-2021-24122Tomcat information disclosure14 Jan 2021

Fixes in tomcat-embed-coreMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

6.0.18CVE-2008-19474 Jun 2008
7.0.79CVE-2017-1261519 Sep 2017KEV
8.0.4CVE-2014-009531 May 2014
9.0.0.M18CVE-2017-564817 Apr 2017
9.0.0.M19CVE-2017-565117 Apr 2017
9.0.1CVE-2017-126174 Oct 2017KEVLatest listed

techniques

2 , grouped by in kill-chain order, 2 cited passages 2

Initial AccessTA0001

Exploit Public-Facing Application T1190 Medium

AI mapping from the description · how it is exploited

Crafted HTTP PUT request exploits public-facing web app

it was possible to upload a JSP file to the server via a specially crafted request

From the official description (NVD) Original ↗

PersistenceTA0003

Web Shell T1505.003 Medium

AI mapping from the description · primary impact

Uploaded JSP webshell enables server-side code execution

This JSP could then be requested and any code it contained would be executed by the server

From the official description (NVD) Original ↗

Detection

0 rules for this CVE · 184 general rules for its techniques

Rules for this CVE

0 that reference CVE-2017-12615 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Exploit Public-Facing ApplicationT1190149 general rules

Arcadyan Router Exploitationscriticaltest
Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195criticaltest
Citrix Netscaler Attack CVE-2019-19781criticaltest
Confluence Exploitation CVE-2019-3398criticaltest
CVE-2010-5278 Exploitation Attemptcriticaltest
CVE-2020-0688 Exchange Exploitation via Web Logcriticaltest
CVE-2020-10148 SolarWinds Orion API Auth Bypasscriticaltest
CVE-2020-5902 F5 BIG-IP Exploitation Attemptcriticaltest

All 149 on SigmaHQ ↗

Web ShellT1505.00335 general rules

Certificate Request Export to Exchange Webservercriticaltest
CVE-2021-40539 Zoho ManageEngine ADSelfService Plus Exploitcriticaltest
Mailbox Export to Exchange Webservercriticaltest
Oracle WebLogic Exploitcriticaltest
Solarwinds SUPERNOVA Webshell Accesscriticaltest
Webshell Remote Command Executioncriticaltest
WordPress Wp2shell Webshell Plugin Accesscriticalexperimental
Antivirus - Web Shell Detection Signaturehightest

All 35 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.apache.tomcat.embed:tomcat-embed-core.

Mavenorg.apache.tomcat.embed:tomcat-embed-coreGHSA-pjfr-qf3p-3q25

Upgrade to 7.0.104 or later

Fixes this CVE and 6 other known vulnerabilities in this package (CVE-2017-12617, CVE-2018-11784, +4).

Set the version to 7.0.104 or later in your pom.xml or build.gradle.

First fixed in 7.0.79 for CVE-2017-12615.

Affected versions

If you run	Upgrade to
7.0.0 up to 7.0.79	7.0.104first fix for this CVE: 7.0.79

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
TSEC Honeypot: Exploit Attempt - Week of 2026-10-1923 Oct 2026
Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
44 more on OTX

References

20 links, grouped by NVD tag (19 duplicates merged)

Show 4 moreShow fewer

github.com/breaktoprotect/CVE-2017-12615 security.netapp.com/advisory/ntap-20171018-0001/exploit-db.com/exploits/42953/synology.com/support/security/Synology_SA_17_54_Tomcat

Exploit 1

breaktoprotect.blogspot.com/2017/09/the-case-of-cve-2017-12615-tomcat-7-put.html

Mailing List 2

lists.apache.org/thread.html/8fcb1e2d5895413abcf266f011b9918ae03e0b7daceb118ffbf23f8c%40%3Cannounce.tomcat.apache.org%3E lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E

Exploitation evidence

Exploited in the wild

Listed since 25 Mar 2022. Federal due date 15 Apr 2022. Known ransomware use.

Apply updates per vendor instructions.

ENISA

Marked exploited since 25 Mar 2022. EUVD-2018-0654

Apache Tomcat < 9.0.1 (Beta) / < 8.5.23 / < 8.0.47 / < 7.0.8 - JSP Upload Bypass / Remote Code Execution (1)EDB-42953 · webapps · windows · 2017-09-20

, 30 Oct 2026

99.7%Top 0.05%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.95%).

3.1

8.1High · 8.1

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Priority factorsFormula

In a KEV cataloglisted in CISA KEV and VulnCheck KEV 35.0/35

Recent KEV listingadded 2853 days ago 0.0/10

Known ransomware useCISA KEV and VulnCheck KEV: Known 10.0/10

EPSS percentilepercentile 0.9995 20.0/20

Threat reports0 reports 0.0/10

Public exploit code2 NVD references tagged Exploit; 1 Exploit-DB entry; 1 NVD exploit link; 1 advisory exploit reference; 17 PoC-in-GitHub repos; 1 nuclei template 5.0/5

Mentioned in OTX pulses50 pulses 3.0/3

CVSS base scorebase score 8.1 5.7/7

End-of-life productsupported or unknown 0.0

Total78.7

Record

Published: 19 Sep 2017
Modified: 6 Aug 2026
: CWE-434 Unrestricted Upload of File with Dangerous Type
Elsewhere: NVD CVE.org KEV JSON

How an attack unfolds

1How attackers get in

2What they do

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

Patch historyPatch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.