CVE-2017-12617 Code Execution flaw patched in Apache Tomcat

Apache Tomcat 7.0.0 through 7.0.79 running on Windows with HTTP PUT enabled on the Default servlet (the readonly initialisation parameter set to false, which is not the default configuration) allows an unauthenticated attacker to upload a JSP file via a specially crafted PUT request (CWE-434), bypassing the extension check (e.g. via trailing-slash or case variations). The uploaded JSP can then be requested, and any code it contains is executed in the Tomcat server context, giving the attacker unauthenticated remote code execution. Only Tomcat 7 deployments on Windows with PUTs enabled are directly affected; because bundled Tomcat is also shipped in products from Red Hat (JBoss Enterprise Web Server, RHEL variants) and NetApp, those vendors issued advisories as well. This flaw is closely related to CVE-2017-12617, which was reported and patched around the same time. Exploitation is confirmed in the wild: it was added to CISA KEV on 2022-03-25 with known ransomware use, has two public proof-of-concept references, and EPSS assigns a 99.6% probability of exploitation within 30 days.

Do: Upgrade Tomcat beyond the affected 7.0.0–7.0.79 range per vendor instructions (Apache Tomcat directly, or via Red Hat JBoss Enterprise Web Server/RHEL and NetApp bundled-product advisories), prioritizing internet-facing Windows servers since the issue is KEV-listed with known ransomware use. If patching must be delayed, ensure the Default servlet readonly parameter remains at its default (true) to disable PUT, or block PUT requests at a reverse proxy/WAF on Windows Tomcat hosts. Also check affected Windows hosts for unexpectedly uploaded .jsp files and review access logs for PUT requests that created JSPs, as indicators of compromise.

CVE-2017-12617 is a file-upload vulnerability (CWE-434) in Apache Tomcat in which a specially crafted request can upload a JSP file to the server, and any code in that file is executed when the file is later requested, enabling remote code execution. Any organization running an affected version of Apache Tomcat is exposed. Because it allows arbitrary code execution on the web server, it can lead to full server compromise, and it is listed in CISA's Known Exploited Vulnerabilities catalog with a maximal 100% EPSS probability of exploitation within 30 days.

Do: Apply updates to Apache Tomcat per vendor instructions, which is the required action for this CISA KEV-listed vulnerability. Prioritize patching internet-facing Tomcat instances given the very high likelihood of exploitation, and review patched servers for unexpected or recently created JSP files that could indicate prior exploitation.