Advisory details:
gitlab / maven/org.apache.tomcat.embed/tomcat-embed-core/CVE-2017-12617
| Advisory ID | gitlab/maven/org.apache.tomcat.embed/tomcat-embed-core/CVE-2017-12617 |
| Aliases |
CVE-2017-12617
GHSA-xjgh-84hx-56c5 |
| Summary | Unrestricted Upload of File with Dangerous Type Apache Tomcat When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server. |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 0.0 |
| Risk | |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| Data source | KEV |
|---|---|
| Date added | March 25, 2022 |
| Description | When running Apache Tomcat, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server. |
| Required action | Apply updates per vendor instructions. |
| Due date | April 15, 2022 |
| Note | https://nvd.nist.gov/vuln/detail/CVE-2017-12617 |
| Ransomware campaign use | Unknown |
| Data source | Exploit-DB |
|---|---|
| Date added | Oct. 17, 2017 |
| Description | Tomcat - Remote Code Execution via JSP Upload Bypass (Metasploit) |
| Ransomware campaign use | Known |
| Source publication date | Oct. 17, 2017 |
| Exploit type | remote |
| Platform | java |
| Source update date | Oct. 17, 2017 |
| Source URL | https://raw.githubusercontent.com/rapid7/metasploit-framework/cfaa34d2a4b688780cd21fa3a48deaa56698c52e/modules/exploits/multi/http/tomcat_jsp_upload_bypass.rb |
| Data source | Metasploit |
|---|---|
| Description | This module uses a PUT request bypass to upload a jsp shell to a vulnerable Apache Tomcat configuration. |
| Note | Stability: - crash-safe Reliability: - repeatable-session SideEffects: - artifacts-on-disk - ioc-in-logs |
| Ransomware campaign use | Unknown |
| Source publication date | Oct. 3, 2017 |
| Platform | Linux,Windows |
| Source URL | https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/multi/http/tomcat_jsp_upload_bypass.rb |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Exploitability (E) | Access Vector (AV) | Access Complexity (AC) | Authentication (Au) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|
high functional unproven proof_of_concept not_defined |
local adjacent_network network |
high medium low |
multiple single none |
none partial complete |
none partial complete |
none partial complete |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
Vector: SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-04T18:46:14Z/
Decision: Attend
Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2017/12xxx/CVE-2017-12617.json
Source Advisory: vulnrichment/CVE-2017-12617
[{'Exploitation': 'active'},
{'Automatable': 'no'},
{'Technical Impact': 'total'},
{'Mission Prevalence': 'minimal'},
{'Public Well-being Impact': 'material'},
{'Mission & Well-being': 'medium'}]