CVE-2017-12615
Apache Tomcat on Windows Remote Code Execution Vulnerability
Description
CVE-2017-12615 is a high-severity file upload vulnerability affecting Apache Tomcat. When running Apache Tomcat on Windows with HTTP PUTs enabled, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server. An attacker can exploit this flaw without authentication over the network. CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 94.22% (99.9th percentile) indicates a significantly elevated exploitation probability. This vulnerability is known to have been used in ransomware campaigns.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apache | tomcat | >= 7.0.0, <= 7.0.79 |
| netapp | 7-mode transition tool | - |
| netapp | oncommand balance | - |
| netapp | oncommand shift | - |
| redhat | enterprise linux server update services for sap solutions | 7.4; 7.6; 7.7 |
| redhat | jboss enterprise web server | 2.0.0; 3.0.0 |
| redhat | jboss enterprise web server text-only advisories | - |
| redhat | enterprise linux desktop | 6.0; 7.0 |
| redhat | enterprise linux eus | 7.4; 7.5; 7.6; 7.7 |
| redhat | enterprise linux eus compute node | 7.4; 7.5; 7.6; 7.7 |
| redhat | enterprise linux for ibm z systems | 7.0_s390x |
| redhat | enterprise linux for ibm z systems eus | 7.4_s390x; 7.5_s390x; 7.6_s390x; 7.7_s390x |
| redhat | enterprise linux for power big endian | 7.0_ppc64 |
| redhat | enterprise linux for power big endian eus | 7.4_ppc64; 7.5_ppc64; 7.6_ppc64; 7.7_ppc64 |
| redhat | enterprise linux for power little endian | 7.0_ppc64le |
| redhat | enterprise linux for power little endian eus | 7.4_ppc64le; 7.5_ppc64le; 7.6_ppc64le; 7.7_ppc64le |
| redhat | enterprise linux for scientific computing | 7.0 |
| redhat | enterprise linux server | 6.0; 7.0 |
| redhat | enterprise linux server aus | 7.4; 7.6; 7.7 |
| redhat | enterprise linux server for power little endian update services for sap solutions | 7.4_ppc64le; 7.6_ppc64le; 7.7_ppc64le; 9.2_ppc64le |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://breaktoprotect.blogspot.com/2017/09/the-case-of-cve-2017-12615-tomcat-7-put.html(Exploit)
- http://www.securityfocus.com/bid/100901(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1039392(Broken Link, Third Party Advisory, VDB Entry)
- https://access.redhat.com/errata/RHSA-2017:3080(Third Party Advisory)
- https://access.redhat.com/errata/RHSA-2017:3081(Third Party Advisory)
- https://access.redhat.com/errata/RHSA-2017:3113(Third Party Advisory)
- https://access.redhat.com/errata/RHSA-2017:3114(Third Party Advisory)
- https://access.redhat.com/errata/RHSA-2018:0465(Third Party Advisory)
- https://access.redhat.com/errata/RHSA-2018:0466(Third Party Advisory)
- https://github.com/breaktoprotect/CVE-2017-12615(Exploit, Third Party Advisory)
- https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E(Mailing List, Patch)
- https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E(Mailing List, Patch)
- https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E(Mailing List, Patch)
- https://lists.apache.org/thread.html/8fcb1e2d5895413abcf266f011b9918ae03e0b7daceb118ffbf23f8c%40%3Cannounce.tomcat.apache.org%3E(Issue Tracking, Mailing List)
- https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E(Mailing List)
- https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E(Mailing List, Patch)
- https://security.netapp.com/advisory/ntap-20171018-0001/(Third Party Advisory)
- https://www.exploit-db.com/exploits/42953/(Third Party Advisory, VDB Entry)
- https://www.synology.com/support/security/Synology_SA_17_54_Tomcat(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-12615(US Government Resource)
Weakness Type
CWE-434: Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type occurs when software allows users to upload files without properly validating, restricting, or handling the file types. Attackers can upload files with dangerous content such as web shells, scripts, or executables that can be executed on the server. In the case of CVE-2017-12615, this weakness allows attackers to compromise Apache Tomcat systems.
Learn more: CWE-434 — Unrestricted Upload of File with Dangerous Type
Impact Analysis
CVE-2017-12615 carries a CVSS 3.1 base score of 8.1 (HIGH), reflecting the serious risk it poses to affected environments. Successful exploitation can lead to complete compromise of data confidentiality, full system integrity compromise, and complete denial of service. The attack vector is network-based with high complexity, meaning exploitation requires specific conditions to be met. Organizations running Apache Tomcat face tangible risk of unauthorized access, data breaches, and operational disruption if this vulnerability remains unpatched.
Exploit Maturity
CVE-2017-12615 is listed in the CISA Known Exploited Vulnerabilities catalog with a remediation deadline of 2022-04-15, confirming that real-world exploitation has been observed. The EPSS score of 94.22% (99.9th percentile) places this vulnerability among those most likely to be exploited. Public exploit code is available in vulnerability databases, lowering the barrier for attackers and increasing the urgency of remediation. This vulnerability has been associated with ransomware campaigns, highlighting its use by financially motivated threat actors.
Remediation
- Apply updates per vendor instructions. This is the CISA-mandated remediation action and should be prioritized immediately.
- If patches cannot be applied immediately, restrict network access to the affected Tomcat management interfaces to only trusted administrative networks using firewall rules or access control lists.
- Monitor vendor security advisories for additional updates and ensure a patch management process is in place for timely deployment.
- Conduct a thorough review of affected systems for signs of prior compromise, including unexpected user accounts, modified configurations, and unusual network activity.
- Implement defense-in-depth measures including network segmentation, intrusion detection systems, and continuous security monitoring for the affected infrastructure.
Technical Details
CVE-2017-12615 is exploitable remotely over the network without any prior authentication. When running Apache Tomcat on Windows with HTTP PUTs enabled, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server. The attack complexity is rated high, meaning specific conditions must be met for successful exploitation. The scope is unchanged, meaning the impact is confined to the vulnerable component. The CVSS 3.1 base score of 8.1 reflects the combination of these factors and the potential for significant damage to affected systems.
Frequently Asked Questions
Is CVE-2017-12615 being actively exploited?
Yes. CISA has confirmed active exploitation by adding CVE-2017-12615 to the Known Exploited Vulnerabilities catalog. The EPSS score of 94.22% (99.9th percentile) further indicates high exploitation likelihood. This vulnerability has also been linked to ransomware campaigns.
What products are affected by CVE-2017-12615?
CVE-2017-12615 affects Apache Tomcat. Specifically, affected products include apache tomcat, netapp 7-mode transition tool, netapp oncommand balance, netapp oncommand shift, redhat enterprise linux server update services for sap solutions, and others.
How do I fix CVE-2017-12615?
Apply updates per vendor instructions. Ensure your systems are updated to the latest patched version. If immediate patching is not feasible, restrict network access to the affected system's management interfaces.
How severe is CVE-2017-12615?
CVE-2017-12615 has a CVSS 3.1 score of 8.1 (HIGH). This is a high-severity vulnerability that poses significant risk and requires prompt remediation. The vulnerability enables unauthenticated remote attackers to potentially compromise affected Tomcat systems.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.