HTTP: Apache Tomcat HTTP PUT Windows Remote Code Execution

This signature detects attempts to exploit a known vulnerability in Apache Tomcat running on Windows. A remote attacker can exploit this vulnerability by uploading a specially crafted JSP page to the vulnerable server. This can result in remote code execution in the context of the affected service.

Extended Description

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

Affected Products

Redhat jboss_enterprise_web_server

References

BugTraq: 100901

CVE: CVE-2017-12617

URL: http://tomcat.apache.org/security-7.html#fixed_in_apache_tomcat_7.0.82

Short Name

HTTP:APACHE:TOMCAT-PUT-RCE

Severity

Major

Recommended

True

Recommended Action

Drop

HTTP: Apache Tomcat HTTP PUT Windows Remote Code Execution

Extended Description

Affected Products

References

Found a potential security threat?