Advisory details:
github_osv / GHSA-xjgh-84hx-56c5
| Advisory ID | github_osv/GHSA-xjgh-84hx-56c5 |
| Aliases |
CVE-2017-12617
|
| Summary | Unrestricted Upload of File with Dangerous Type Apache Tomcat When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server. |
| Status | Published |
| Exploitability | 2.0 |
| Weighted Severity | 7.3 |
| Risk | 10.0 |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| System | Score | Found at |
|---|---|---|
| cvssv3 | 8.1 | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-xjgh-84hx-56c5/GHSA-xjgh-84hx-56c5.json |
| generic_textual | HIGH |
| Data source | Exploit-DB |
|---|---|
| Date added | Oct. 17, 2017 |
| Description | Tomcat - Remote Code Execution via JSP Upload Bypass (Metasploit) |
| Ransomware campaign use | Known |
| Source publication date | Oct. 17, 2017 |
| Exploit type | remote |
| Platform | java |
| Source update date | Oct. 17, 2017 |
| Source URL | https://raw.githubusercontent.com/rapid7/metasploit-framework/cfaa34d2a4b688780cd21fa3a48deaa56698c52e/modules/exploits/multi/http/tomcat_jsp_upload_bypass.rb |
| Data source | KEV |
|---|---|
| Date added | March 25, 2022 |
| Description | When running Apache Tomcat, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server. |
| Required action | Apply updates per vendor instructions. |
| Due date | April 15, 2022 |
| Note | https://nvd.nist.gov/vuln/detail/CVE-2017-12617 |
| Ransomware campaign use | Unknown |
| Data source | Metasploit |
|---|---|
| Description | This module uses a PUT request bypass to upload a jsp shell to a vulnerable Apache Tomcat configuration. |
| Note | Stability: - crash-safe Reliability: - repeatable-session SideEffects: - artifacts-on-disk - ioc-in-logs |
| Ransomware campaign use | Unknown |
| Source publication date | Oct. 3, 2017 |
| Platform | Linux,Windows |
| Source URL | https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/multi/http/tomcat_jsp_upload_bypass.rb |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
There are no SSVC decisions available.