Apache · Tomcat
The flaw is an unrestricted file upload in Apache Tomcat's Default servlet, which affects the 9.0, 8.5, 8.0 and 7.0 release lines within the listed version ranges. An unauthenticated remote attacker can exploit it over the network without user interaction, but only when HTTP PUT is enabled, for example by setting the Default servlet's readonly initialisation parameter to false, to upload a JSP file that the server then executes when requested.
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
First seen exploited 18 months after disclosure. Public exploit code (Metasploit) was available 1 day before disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
3 related vulnerabilities in the same code over 3 years. The latest fix listed for tomcat-embed-core is 9.0.17.
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
Remote unauthenticated exploit of public-facing web server
it was possible to upload a JSP file to the server via a specially crafted request
Uploaded JSP enables server-side code execution
any code it contained would be executed by the server
Uploaded JSP web shell persists on server
This JSP could then be requested and any code it contained would be executed by the server
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
2 packages in 1 ecosystem. No single main package: each of these ships the affected code.
Reports are matched by finding the exact id CVE-2017-12617 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
RCE for Cisco switchesSID: 41909 - 41910CVE-2017-6736: Remote Code Exploit (RCE) for Cisco integrated Service Router 2811SID: 43424 - 43432CVE-2017-12617: RCE affecting Apache web servers running TomcatSID: 44531CVE-2018-0296: Directory traversal to gain unauthorized access to Cisco Adaptive Security…
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.